Outlook Rule "delete it" Created on Multiple Computers

Question

I'm a system administrator at a small university with about 150 full time staff.

In the past week, I've had two clients report that they're not getting any emails. On examination, we find that they are getting messages, but the messages are moved immediately to the trash. Both users are using Outlook 2010 connected to our exchange server. They may occasionally use OWA when accessing remotely.

We examined their message rules and found a rule entitled "delete it". The rule says

After the message arrives
Move it to the trash

Makes sense!

Finding this on one user's computer looked like a foolish user move (experimenting with rules) or a prank. Finding this on two accounts makes me suspicious of foul play.

Question: My googling has turned up few/no reports of this being a common situation. Am I seeing a new situation? Are there known phishing attempts that create this behavior?

Thanks!

Answer 1

Yeah, because TWO users couldn't possibly make the same silly mistake. ;)

Delete it, does it come back? If so, THEN worry about it.

And if it does come back, I'd suggest starting with checking for policies pushing out rules to the user before assuming there's a huge phishing ring out there determined to move peoples emails to their recycling bin (how would that help a phisher exactly?). :)