Junk email messages multiplying without user actions in Shared Mailboxes

Last Updated: September 29, 2022

ISSUE

We are receiving some reports of Junk email messages multiplying in Shared Mailboxes with multiple Delegates. The messages are delivered only once, and at some point, there are multiple copies of the same messages being created on the Shared Mailbox.

STATUS: FIXED

Most cases with this issue were resolved by updating ESET Endpoint Security. Since the fix for ESET Endpoint Security resolved the cases we are closing this issue.

In some of the recent cases with this issue customers are using ESET Endpoint Security. In case this could be related, if you are using ESET Endpoint Security please make sure you are updated to ESET Endpoint Antivirus and ESET Endpoint Security version 9.1.2057 or higher, ESET Endpoint products for Windows version 9.1.2057 have been released - ESET Endpoint Products - ESET Security Forum.

Reference:

Changelog:

Version 9.1.2057

Fixed: Problems with Junk folder scanning on shared mailboxes

While our support teams investigate such reports there are some details that organizations can look for in case there are any affected Shared Mailboxes:

Confirm that neither the Shared nor any of the Delegates’ mailboxes are configured in an Office build older than 12125.10000. If there are please make sure to update as soon as possible: Update history for Microsoft 365 Apps.
Confirm whether the affected Shared Mailbox has duplicated Junk Email folders by opening it through Outlook on the web in a separate browser window: Open and use a shared mailbox in Outlook on the web.

We do suspect the behavior to be caused by a corrupted Junk Email Rule in one or multiple Delegates’ mailbox. If there is an affected Shared Mailbox in your organization with a high number of Delegates, we recommend you open a Support Request with Microsoft to investigate which Delegate(s) caused the duplication.

If your affected Shared Mailbox only has a small number of Delegates, then the following action plan can be applied:

Make sure that neither the Shared nor any of the Delegates’ mailboxes are configured in an Office build older than 12125.10000. If they are please update before moving to the next step: Update history for Microsoft 365 Apps.
Remove the Delegates’ permissions from the affected Shared Mailbox.
After waiting a couple of hours delete the duplicated emails from the mailbox by running the following command in Exchange Online PowerShell:

Get-Mailbox <Affected Mailbox> -ResultSize unlimited | Search-Mailbox -SearchQuery 'Subject:"Subject of the duplicated message"' -DeleteContent -Force
Delete the Junk Email Rule using MFCMAPI for the Delegates’ mailbox: Delete junk email rules by using MFCMAPI - Exchange | Microsoft Docs.
Re-add permissions to the Delegates over the Shared Mailbox.