The following email was marked to have been sent on the 15th August however it was received on the 6th September.
All of the datestamps on the email except for the first one are for the 6th September (some are the 7th but that's because the receiving server was PDT rather than GMT).
The sender is claiming that this email was sent from their machine on the 15th August, almost three weeks before. Is it possible that this is true? Is there any way that it could have left their machine and then got stuck somewhere until the 6th?
First email: all timestamps are dated three weeks after the 'sent' date
Delivered-To: xxxxxxxx
Received: by 10.231.4.202 with SMTP id 10cs144069ibs;
Tue, 6 Sep 2011 20:25:32 -0700 (PDT)
Received: by 10.227.152.129 with SMTP id g1mr5802672wbw.56.1315365931065;
Tue, 06 Sep 2011 20:25:31 -0700 (PDT)
Return-Path: <xxxxxxxx>
Received: from coumta04.netbenefit.co.uk (coumta04.netbenefit.co.uk [95.130.76.115])
by mx.google.com with ESMTP id 21si9249722wbw.107.2011.09.06.20.25.29;
Tue, 06 Sep 2011 20:25:30 -0700 (PDT)
Received-SPF: neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) client-ip=95.130.76.115;
Authentication-Results: mx.google.com; spf=neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) smtp.mail=xxxxxxxx
Received: from [84.252.254.11] (port=1257 helo=xxxxxxxx)
by coumta04.netbenefit.co.uk with esmtp (NBT 4.72 2)
id 1R18lR-0001SR-DZ
for xxxxxxxx; Wed, 07 Sep 2011 04:25:29 +0100
Return-Receipt-To: "xxxxxxxx" <xxxxxxxx>
Subject: xxxxxxxx
Date: Mon, 15 Aug 2011 15:51:10 +0100
Message-ID: <xxxxxxxx>
X-MS-Has-Attach: yes
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----_=_NextPart_001_01CC5B5A.C52AC300"
X-MS-TNEF-Correlator:
Thread-Topic: xxxxxxxx
Thread-Index: xxxxxxxx
Disposition-Notification-To: xxxxxxxx
Content-class: urn:content-classes:message
From: xxxxxxxx
X-MimeOLE: Produced By Microsoft Exchange V6.5
To: xxxxxxxx
X-NB-Virus-Scan: virus-free
X-Originally-To: xxxxxxxx
This is a multi-part message in MIME format.
------_=_NextPart_001_01CC5B5A.C52AC300
Content-Type: multipart/alternative;
boundary="----_=_NextPart_002_01CC5B5A.C52AC300"
------_=_NextPart_002_01CC5B5A.C52AC300
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
xxxxxxxx
------_=_NextPart_002_01CC5B5A.C52AC300
xxxxxxxx
------_=_NextPart_002_01CC5B5A.C52AC300--
------_=_NextPart_001_01CC5B5A.C52AC300
Content-Type: image/jpeg;
name="xxxxxxxx"
Content-Transfer-Encoding: base64
Content-Description: xxxxxxxx
Content-Location: xxxxxxxx
xxxxxxxx
------_=_NextPart_001_01CC5B5A.C52AC300--
EDIT
There was a second email that arrived simultaneously with the first. Both emails came from the same company however they were from different individuals and presumably computers at that company. Although a possible answer is that the individual forgot to press "send and receive" for three weeks or that the email got caught in Outlook it becomes far less likely with two such emails.
Second simultaneous email sent by a different person at the same company (2wks later)
The company did not claim or complain of any internet outage during this period. Note that the first hop of the second email is 7 seconds before the first hop of the previous email while the "sent date" is apparently two weeks later:
Delivered-To: xxxxxxxx
Received: by 10.231.4.202 with SMTP id 10cs144068ibs;
Tue, 6 Sep 2011 20:25:26 -0700 (PDT)
Received: by 10.216.229.88 with SMTP id g66mr2963523weq.9.1315365924837;
Tue, 06 Sep 2011 20:25:24 -0700 (PDT)
Return-Path: <xxxxxxxx>
Received: from coumta04.netbenefit.co.uk (coumta04.netbenefit.co.uk [95.130.76.115])
by mx.google.com with ESMTP id u35si8835621weq.122.2011.09.06.20.25.23;
Tue, 06 Sep 2011 20:25:23 -0700 (PDT)
Received-SPF: neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) client-ip=95.130.76.115;
Authentication-Results: mx.google.com; spf=neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) smtp.mail=xxxxxxxx
Received: from [84.252.254.11] (port=1257 helo=xxxxxxxx)
by coumta04.netbenefit.co.uk with esmtp (NBT 4.72 2)
id 1R18lO-0001SR-G0
for xxxxxxxx; Wed, 07 Sep 2011 04:25:23 +0100
Subject: xxxxxxxx
Date: Tue, 30 Aug 2011 10:49:00 +0100
Message-ID: <xxxxxxxx>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----_=_NextPart_001_01CC66FA.0B9BFD72"
Thread-Topic: xxxxxxxx
Thread-Index: Acxm+gtdtV3BSonSR826xyTFQoiE9w==
From: "xxxxxxxx" <xxxxxxxx>
Content-class: urn:content-classes:message
To: <xxxxxxxx>
X-MimeOLE: Produced By Microsoft Exchange V6.5
Cc: "xxxxxxxx" <xxxxxxxx>
X-NB-Virus-Scan: virus-free
X-Originally-To: xxxxxxxx
This is a multi-part message in MIME format.
------_=_NextPart_001_01CC66FA.0B9BFD72
Content-Type: multipart/alternative;
boundary="----_=_NextPart_002_01CC66FA.0B9BFD72"
------_=_NextPart_002_01CC66FA.0B9BFD72
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
xxxxxxxx
------_=_NextPart_002_01CC66FA.0B9BFD72
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
xxxxxxxx
------_=_NextPart_002_01CC66FA.0B9BFD72--
xxxxxxxx
------_=_NextPart_001_01CC66FA.0B9BFD72
Content-Type: image/jpeg;
name="xxxxxxxx"
Content-Transfer-Encoding: base64
Content-Description: xxxxxxxx
Content-Location: xxxxxxxx
xxxxxxxx
------_=_NextPart_001_01CC66FA.0B9BFD72--
I know that changing the computer clock will cause Outlook to give an outgoing mailstamp equivalent to this one however I would like to know whether there is any legitimate reason for this.