A user is unexpectedly getting a lot of email reports from Microsoft Office 365 starting:

# Questionable URLs detected in message:

After this follows the headings of the reported email. These emails look like they were sent by various people within the same organisation, but obviously, they were not sent manually.

The issue was caused by the user’s mailbox being selected as the reporting mailbox in Microsoft 365 Defender Admin Centre > Settings > Email & Collaboration > User reported settings > Reported message destinations. 

 

 

After setting “Send reported messages to” as “Microsoft Only” the issue was resolved.

November 2023
Microsoft Office 365 
Exchange Online