spma mail hakkında

Merhaba

çözemediğim br durum var.  exchange server 2013 kullanıyoruz. emal security cloud ortamında trend micro kullanıyoruz. localde dolaşan mailler için bir güvenlik uygulamamız yok. içeriden dışarıya ve dışarıdan içeriye cloud sistemini kullanıyoruz. kullanıcıya aşağıdaki detayları belirtilen bir mail var ve spam mail. fakat bu mail dışırıdan atılan bir mail değil. zaten loglardada yok. fakat çözemedim. bu mail nasıl atılıyor, atan kim

Received: from mail2.sirket.local (172.20.10.10) by
mail1.sirket.local (10.80.1.220) with Microsoft SMTP Server (TLS) id
15.0.1497.18 via Mailbox Transport; Tue, 29 Jun 2021 11:15:28 +0300
Received: from cas.sirket.local (172.20.10.12) by
mail2.sirket.local (172.20.10.10) with Microsoft SMTP Server (TLS) id
15.0.1497.18; Tue, 29 Jun 2021 11:15:27 +0300
Received: from inpost.tmes.trendmicro.eu (18.185.115.170) by
cas.sirket.local (172.20.10.12) with Microsoft SMTP Server id
15.0.1497.18 via Frontend Transport; Tue, 29 Jun 2021 11:15:27 +0300
Received: from 112.78.125.90_tmes.trendmicro.com (unknown [172.21.191.189])
by inpost.tmes.trendmicro.eu (Postfix) with SMTP id 5353B1006F1D6
for <[email protected]>; Tue, 29 Jun 2021 08:15:27 +0000 (UTC)
X-TM-MAIL-RECEIVED-TIME: 1624954478.941000
X-TM-MAIL-UUID: 2afbd30f-010e-41e8-b7fe-69a36af3199f
Received: from www630b.sakura.ne.jp (unknown [112.78.125.90])
by inpre01.tmes.trendmicro.eu (Trend Micro Email Security) with ESMTPS id E5FAA100028EB
for <[email protected]>; Tue, 29 Jun 2021 08:14:38 +0000 (UTC)
Received: from www630b.sakura.ne.jp (localhost [127.0.0.1])
by www630b.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 15T8ELPl035687
for <[email protected]>; Tue, 29 Jun 2021 17:14:21 +0900 (JST)
(envelope-from [email protected])
Received: (from approg-wsv01@localhost)
by www630b.sakura.ne.jp (8.15.2/8.15.2/Submit) id 15T8ELaY035686;
Tue, 29 Jun 2021 17:14:21 +0900 (JST)
(envelope-from approg-wsv01)
Date: Tue, 29 Jun 2021 08:14:21 +0000
To: <[email protected]>
From: =?utf-8?Q?Microsoft=20Outlook?= <[email protected]>
Subject: =?utf-8?Q?A=20new=20Voice=20message=20is=20shared=20with=20you?=
Message-ID: <[email protected]>
X-Priority: 3
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 8bit
X-TM-AS-ERS: 112.78.125.90-127.9.0.1
X-TMASE-Version: StarCloud-1.3-8.6.1017-26248.004
X-TMASE-Result: 10-4.829400-10.000000
X-TMASE-MatchedRID: kkaA0vpgvZE7MwFDNigBPkj3FR4SUIEs0ttJ7HKtLsIrdBjOm5V01AEG
qnKsMnX0EXIhhl7oVxIrCLswi3NpjYTv92wnOMJfB4sIhfTjqIFKslM7VUaEwUTL4vWH26eWssC
6sjl+wBVx6NqeNlYcmNszWfm77NPrJScvOTX4jHNL/3rQmWrTBpt+dMPP5rY5ysFV3a6nt0J3ET
XqN2u0XKaDx0F8sKdXZBiPr4EU8TBU4sxFq6igEcwCk4rhHwXiH9fAs8vd7OE77ooU2kaiVU856
UUDqysAtMT1y9P9VbJHKdPCX1liHvioIsi7Sa0gAO2rizfmm039VAbehV/HfhilGw8b1D9DQhdV
9r66doiqgpa//D0NTi+PrAd8gbHJHAwy0XhreD0+P4MEjL4hFJSDlQPoCUXSLlAHRs5YGSOvoKS
srAq+jKNC+vFhJ67EngIgpj8eDcBtK8M7OIsa5NQdB5NUNSsi5edvV2zcfLjYmC0C5U0cHmc9AA
BlmIKiTTw2u8aQyIpXKaQsz6vtVJFOlJCK/1ftZzBPybJ/5vo=
X-TMASE-SNAP-Result: 1.821001.0001-0-1-12:0,22:0,33:0,34:0-0
X-TMASE-XGENCLOUD: 1b3cad02-04cb-4f0f-80a5-5424101a3466-0-0-200-0
X-TM-Deliver-Signature: B967532C5EF1CBB0AF4060B69B245E36
Return-Path: [email protected]
X-MS-Exchange-Organization-Network-Message-Id: 62adc1fb-843c-4f21-26ca-08d93ad60db7
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-EXCLAIMER-MD-CONFIG: 5be96b9e-da9a-466f-a713-b024abfe31c9
X-EXCLAIMER-MD-CONFIG: e28ee9e4-d482-4d7f-bf5d-59b32ff97ea8
X-MS-Exchange-Organization-AuthSource: cas.sirket.local
X-MS-Exchange-Organization-AuthAs: Anonymous