I'm a system administrator at a small university with about 150 full time staff.
In the past week, I've had two clients report that they're not getting any emails. On examination, we find that they are getting messages, but the messages are moved immediately to the trash. Both users are using Outlook 2010 connected to our exchange server. They may occasionally use OWA when accessing remotely.
We examined their message rules and found a rule entitled "delete it". The rule says
After the message arrives Move it to the trash
Finding this on one user's computer looked like a foolish user move (experimenting with rules) or a prank. Finding this on two accounts makes me suspicious of foul play.
Question: My googling has turned up few/no reports of this being a common situation. Am I seeing a new situation? Are there known phishing attempts that create this behavior?