I am not having luck finding an email that is being sent to one of our customers every day, once per day (the same original authentic message is being resent) allegedly originating from a user's mailbox. I need to find how/where this is coming from so I can nix it. There is nothing in their outbox indicating a message being sent and I cannot find evidence of it in mailbox.log. Any suggestions? Thanks.