I’ve lost count of how many times this has come up in conversation. Someone mentions an odd email, and twenty minutes later we’re looking at a mailbox rule that forwards a copy of everything to an address nobody recognises.

It’s rarely dramatic. Usually it starts as something reasonable. A person wanted to read work mail on a personal phone. Someone wanted an archive of project threads while switching roles. A contractor set up forwarding during a handover and nobody removed it afterwards.

What I’ve noticed is that inbox rules are among the least reviewed parts of a mail setup. Plenty of teams check access reviews, device enrolment and group membership carefully, and still never open the rules list. The rule just does its job quietly for months.

By the time anyone looks, the forwarding address has often outlived the reason it was created.

What it looks like from the ops side

The first sign tends to be small.

A user mentions that replies arrive oddly fast.…