Is there any way to find the IP of the original client that sent an internal e-mail?
In IIS I can see the connected clients but you cannot see which clients send e-mail.
In the message tracking logs / transport logs I can find the e-mail but depending on the setup I see only the IP address of the Exchange server or the ARR load balancer (weirdly enough???) in the "Original-client-IP" field.
Does anyone know another option? I have looked but haven't found anything though Mailbox Audit Logging looks promising.