How do I investigate vanishing emails from folders/inbox?

[thecomputerguy]

Clients employee contacted me because she said that emails are "disappearing" before her eyes. I log in and sure enough she claims that emails are missing from her folders (which I can't confirm) but also her inbox goes like this:

8/22/25
8/20/25
8/12/25
3/27/25
10/4/24
END

So her emails HARD stop at 10/4/24 but this mailbox is several years old. It's like the emails just vanished.

Things I've verified:

Emails are also missing from Webmail
No server side/ client side rules
No compromise or bad logins via Entra
No Email delegation in place
Not in deleted items
Recover deleted items only goes back to 9/29/25
Archiving is enabled but the emails are not there and appears to be operating normally

They have no O365 backup in place so restoring is not an option but ... I find it impossible that someone would be able to mass perma delete several years worth of mail.

There are two people with the same issue ... I don't understand how this could happen with what I've verified.

 

[HCHTech]

What other admin accounts are there? It sounds like someone has access that they shouldn't have and are using it to screw with this employee.

 

[thecomputerguy]

What other admin accounts are there? It sounds like someone has access that they shouldn't have and are using it to screw with this employee.

There is no delegation for this email address. No admin except for myself who gave myself access to the mailbox to check for server rules.

 

[Markverhyden]

What plan are they using. Does it allow Litigation Hold? If so turning it on will be an easy task. If you don't put some type of control server side then emails can be deleted locally which will then replicate to the server. Also there's a bunch of server side logs you can look at.

 

[callthatgirl]

If emails are missing from OWA, put in a ticket with Microsoft. The mailbox is wonky, they can unwonk it.