User on exchange online did not send an email but somene received an email - is it hacked ?

Hello, @Alex Rabbi,

Welcome to the Microsoft Q&A platform!

According to your description , User A receives an email from User B without User B's knowledge, and email tracking finds the email but it is not visible in User B's sent mailbox.

After my test, it is probably because a user has the “Send As” permission of user B, so it can send emails to user A with user B's email address.

The following figure shows the description of the “Send As” permission for your reference.

Therefore, before suspecting whether the email is spam, phishing or a real hacker attack, please check whether other users have the “Send As” privilege of user B in the following two ways.

1.Use the EAC to manage permissions according to the screenshot below. If other users do have “Send As” or higher privileges for user B, you can remove them as needed.

2.Use Exchange Online PowerShell to check or remove users who you do not want to assign "Send As" permission.

Get-RecipientPermission -Identity userB@domain.com | Where-Object {$_.AccessRights -contains "SendAs"}

Remove-RecipientPermission -Identity user1@example.com -Trustee user2@example.com -AccessRights SendAs

For more guidance, please click on https://zcusa.951200.xyz/en-us/exchange/recipients-in-exchange-online/manage-permissions-for-recipients#use-the-eac-to-assign-permissions-to-individual-mailboxes for reference.

Please try to check as above, if you can rule out the possibility of “Send As” privilege or if there is something else you don't understand, feel free to post back. 

If the answer is helpful please click on ACCEPT ANSWER as it could help other members of the Microsoft Q&A community who have similar questions and are looking for solutions.

Thank you for your support and understanding.

Best Wishes,

Alex Zhang