Question 1

The email came from the executive's address. Isn't that proof she sent it?

Accepted Answer

No: a delegate with send-as rights produces an identical header, and a compromised session produces the same again (§3, §7): Example 1's approval was sent by an assist an t and looked exactly like the director's own. The audit log, permission history and sign-in context prove the actor; the From line proves only the mailbox.

Question 2

Why would a shared mailbox be missed in disclosure?

Accepted Answer

Because it is not a custodian: scoping by named individuals collects their mailboxes and leaves the team inbox untouched, unheld and expiring on its own retention (§5, Example 2). The permission census finds it; the DRD names it as a source; the hold reaches it. Ask every relevant team which inboxes they actually work from.

Question 3

What is the difference between send-as and send-on-behalf, and why does it matter?

Accepted Answer

Send-on-behalf marks the real sender visibly ("A on behalf of B"); send-as does not: the message appears to be B's alone. For attribution, send-on-behalf is answered on the face of the message (if the marker survived production); send-as is answered only from the mailbox audit log (§3, §6): which is why logging status is the first question in any disavowal.

Question 4

Can we prove who created a forwarding rule?

Accepted Answer

Usually: rule creation is an audited event recording the acting account, session and time, and the sign-in log joins the session to a device and location (§4, §6): Example 3's rule was attributed to an external session without MFA. The rule's timing against the dispute is often the most telling fact, and the configuration export documents exactly what it did.

Question 5

Mailbox audit logging was off. Is attribution impossible?

Accepted Answer

Harder, not impossible: the permission census bounds who could have acted, sign-in logs date sessions, recipients' copies prove the send and may hold on-behalf markers, end point artefacts show drafts and client activity (§8). The report states the missing spine and builds the lattice from the rest: and the or g an is at i on turns logging on for next time.

Question 6

The assist an t sent it under standing instructions. Does attribution even matter?

Accepted Answer

It settles the facts so the law can do its work: once the assist an t is established as the sender, the questions become authority, ratification and reliance: Example 1's second half: which the same evidence (the assistant's send-as history, the instructions' scope) informs. Attribution rarely ends a dispute; it ends the argument about what happened so the argument about what it means can be had properly. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Shared Mailboxes Delegated Access And Who Really Sent The Email