Exchange 2010 - the SMTP RCPT TO and the header does not match (Carbon Copy disappears)

Question

Dear All I have to investigate on a weird message which is carbon copied to many people who did not receive it.
As a matter of fact the SmtpReceives log recorded ONLY one person, directly addressed. I mean one SMTP RCPT TO. And the "Message Traking Results" is wholly consistent with it (with only one STOREDRIV). [Server version 14.3 (Build 123.4)]
Unfortunately Outlook 2010 shows a rather different header; in fact three CC are reported.
Any idea how to debug it? In my opinion it just a sender fault; one rcpt to settles things once and for all!
<,MAIL From:<[email protected]> SIZE=9455 BODY=8BITMIME,
>,250 2.1.0 Sender OK,
<,RCPT To:<[email protected]>,
<,DATA,
>,354 Start mail input; end with <CRLF>.<CRLF>,
>,250 2.6.0 <[email protected]> [InternalId=556164] Queued mail for delivery,
<,QUIT,
Thanks in advance.
Here's the Outlook 2010 message property:
Received: from deliver.hol.gr (62.38.3.39) by myMailer.myDomain.it (172.20.1.46) with Microsoft SMTP Server (TLS) id 14.3.210.2; Thu, 13 Nov 2014 10:37:54 +0100
Received: from auth-smtp.hol.gr (takeit01.mail.dc.hol.net [192.168.20.71]) by deliver.hol.gr (8.12.11/8.11.6) with ESMTP id sAD9bo8a027674  (using TLSv1/SSLv3 with cipher DHE-RSA-AES256-SHA (256 bits) verified FAIL) for [email protected]>; Thu, 13 Nov
2014 11:37:50 +0200
Received: from INTERNETPC-7.technomar.gr ([194.30.250.147]) (authenticated bits=0) by auth-smtp.hol.gr (8.13.1/8.13.1) with ESMTP id sAD9bmK9009834 for <[email protected]>; Thu, 13 Nov 2014 11:37:49 +0200
From: <[email protected]>
To: <[email protected]>
Date: Thu, 13 Nov 2014 11:37:48 +0200
Subject: Fw: Re: myTitle
CC: <[email protected]>, <[email protected]>,
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-7"
Content-Transfer-Encoding: 7bit
X-Mailer: Softway Communicator Mailer, SOFTWAY LTD. Piraeus GREECE
X-Virus-Scanned: ClamAV version 0.94.2, clamav-milter version 0.94.2 on takeit01.mail.dc.hol.net
X-Virus-Status: Clean
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: technomar.gr
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (myMailer.myDomain.local: [email protected] does not designate permitted sender hosts)
X-MS-Exchange-Organization-Antispam-Report: ContentFilterConfigBypassedSender
X-MS-Exchange-Organization-SCL: -1

Answer 1

I'm not sure what the question is here, so I'll see if I can go through your command sequences to figure it out.  You have a user with outlook who sent a message to a single recipient with two in the CC line.  In your SMTP sequence, that is the
RCPT to: [email protected] line.  You have no other recipients on the To: line, so any other recipients will be in the DATA section of the message.  I don't see any info in your
SMTP sequence that shows what the subject and CC lines were set to, so I'm going to assume those are not included in this information.
Now, since the To: line is covered in the RCPT To: line, and you agree that there was one recipient on that line, what question are we working on?  If it's where the Cc: line recipients are, as I said, they should be in the DATA section which wasn't
included.  Does that help?