I might be in the wrong place but hopefully it's close enough. I have Exchange 2010 (I could not find the Exchange 2010 in the forums).
The long story made short is, I am trying to find users that have accidentally set up rules to automatically delete all of their incoming email.
The long story goes like this. Some time ago some of our users received a phishing email. Some of fell for the tramp and their accounts were compromised. Now they are sending emails like crazy to everybody in their address book. Some of those emails are getting bounce back. I'm thinking that the phishing email might have also created a rule to automatically delete all incoming email (I have seen this on a few computers, the rule has different names). There's a bunch of other boring details but in a nutshell that's it.
I'm trying to come up with a Powershell script to run on all my users, about 4k of them, looking for a rule that deletes all of their incoming email. Any ideas, GREATLY appreciate it.