Blog
They wrote forwarding was removed. The mail flow rule still copies.
At 02:11 Priya removes inbox rule Move to RSS on casey.m. Mail flow rule copy-outbound-invoices still Bccs invoices@mail-copy.example. The scribe writes that forwarding was removed.
At 02:11 on 30 October 2026, Priya S (on-call, platform) removes inbox rule Move to RSS from mailbox casey.m@pay.example. The rule forwarded to invoices@mail-copy.example and then deleted the message. The inject started at 01:40: that inbox rule is on the mailbox, and mail flow rule copy-outbound-invoices, priority 2, state Enabled, Bccs the same address. Marcus T (incident commander) reads the plan. It says: on a suspected mailbox compromise, remove every inbox rule on that mailbox that forwards, redirects, or deletes, and disable every mail flow rule that copies or redirects mail to an outside address. Do not write that forwarding was removed while a mail flow rule still names that address. A mail flow rule is a transport rule. It runs in transport. Get-InboxRule does not list it, and removing an inbox rule does not change it. Priya says Sent Items is clean, so the copy has stopped. She does not open Mail flow. She does not run Get-TransportRule. Ravi M (messaging), who owns mail flow rules, is not on the call. At 02:19 the inject submits a message from casey.m@pay.example to ap@northline.example, subject Invoice 18442. At 02:27 the message trace for that message lists invoices@mail-copy.example as Bcc and names transport rule copy-outbound-invoices, state Enabled. At 02:36 the scribe writes that forwarding was removed, the inbox rule was deleted, and Sent Items is clean.
A weak record of those twenty-five minutes reads:
Forwarding removed. Inbox rule deleted. Sent Items is clean.
A strong one reads:
30 October 2026, 02:11 to 02:36. Incident-response tabletop. Seats: Marcus T (incident commander), Priya S (on-call, platform). Ravi M (messaging, owns mail flow rules) was not on the call. Inject at 01:40: inbox rule Move to RSS on casey.m@pay.example forwards to invoices@mail-copy.example and deletes the message. Mail flow rule copy-outbound-invoices, priority 2, state Enabled, Bccs that same address. Plan: on a suspected mailbox compromise, remove every inbox rule on that mailbox that forwards, redirects, or deletes, and disable every mail flow rule that copies or redirects mail to an outside address. Do not write that forwarding was removed while a mail flow rule still names that address. A mail flow rule is a transport rule. Get-InboxRule does not list it. At 02:11 Priya removes Move to RSS. She opens Sent Items, sees no forward, and says the copy has stopped. She does not open Mail flow. At 02:19 the inject submits Invoice 18442 from casey.m@pay.example to ap@northline.example. At 02:27 the message trace lists invoices@mail-copy.example as Bcc and names copy-outbound-invoices, state Enabled. At 02:36 the scribe writes that forwarding was removed. Facilitator stops the sitting before anyone disables the mail flow rule, before anyone tells casey.m the mailbox is clean, and before anyone writes to the outside address. Nothing was disabled. The 02:27 trace is the inject's trace. Follow-up: Ravi disables copy-outbound-invoices, or writes why that Bcc is still required, by 13 November 2026.
Both notes say forwarding was removed. Only the second shows that at 02:27 the trace still Bccs invoices@mail-copy.example under a rule whose state is Enabled. The first costs you the next invoice. On the night this is real, mail keeps copying to that address after the inbox rule is gone, and a reader in March thinks the copy stopped at 02:11.
An inbox rule is not a mail flow rule
Priya is looking at the mailbox. Move to RSS was a rule on casey.m, and it is gone. copy-outbound-invoices is not on the mailbox. BlindCopyTo is a transport action: the copy is added as the message is routed, and the mailbox owner does not get a folder that lists it. A reader who only runs Get-InboxRule can honestly say the forwarding rule on that mailbox was removed, and still miss the org rule that names the same address.
An application permission that still has Mail.Read after a password reset is a different object, in the Mail.Read post. That grant authenticates as the app. This sitting is a mail flow rule that still copies. A signing secret whose previous version is still inside a task that already started is a different object, in the rotation post. That task held the value from when it started. Calling the phone number that arrived in the same edit is a different miss again, in the callback post. This sitting never places a call.
Sent Items does not show a Bcc
The scribe did not skip the rule. She treated a clean Sent Items folder as a clean tenant. Sent Items is the copy saved when the message was submitted. A transport-rule Bcc is applied after that, and it is not written back into the folder. The plan already said to disable every mail flow rule that copies mail to an outside address, and it already said not to write that forwarding was removed while one still names that address.
If the plan's mailbox step names the inbox rule and does not name mail flow rules, run the free plan self-check before the next sitting. It asks whether the last test produced findings with owners, and whether they were closed. Ravi's follow-up is that finding. A line that says forwarding was removed is a record you can produce, and it is the wrong one.
What the packet records
Write the rule in the free evidence template: the plan sentence, inbox rule Move to RSS removed at 02:11, mail flow rule copy-outbound-invoices still Enabled with a Bcc to invoices@mail-copy.example, the 02:19 message, the 02:27 trace, that nobody opened Mail flow, and that Ravi was absent, with the follow-up date. Hang the inject on the business email compromise family in the scenario library. That family walks a vendor bank-detail change, a CEO-impersonation wire, a recall race, and mailbox compromise. It does not have a minute where an inbox rule is removed and a mail flow rule still Bccs the same outside address. Add this minute. Do not fold it into a line that says forwarding was removed. Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the rule you did not open. The evidence template sits with the other record formats in the template library.
The record shows that these named people left copy-outbound-invoices Enabled and wrote that forwarding was removed. It does not show that the body of Invoice 18442 reached mail-copy.example, and it does not show that disabling the rule would have stopped the next copy. Those are the message content and a trace after the rule is disabled. This file is the mail flow rule they did not open.
Bottom line: write the mail flow rule and its state. Removed is the smoothed version. The packet has to show the Bcc.