I'm kind of curious. i pulled a transport log on our helpdesk generic account and i only see Deliver. Don't see Receive or Send beforehand top2 and bottom 2 are separate emails. I also don't see the message on protocol received logs.
As a backstory. A message came through from helpdesk email account to the same helpdesk account, but message was from the user making a request. I looked under sent items but couldn't find anything.
This helpdesk account is restricted only to a few users. I don't believe that open relay was used to spoof the email account.
On a message header From: and To: is the helpdesk account.
Don't see anything for this message on the protocol logs