emails being sent twice on different days

Hi @Anil Gulati 

Please note that this is a user-to-user support forum. Moderators, contributors, and external Microsoft employees do not have access to back-end systems to investigate root causes. Our role here is limited to sharing technical guidance based on publicly available resources and experience.   

From your description and the channel tag, the mailbox appears to be hosted in Microsoft 365 (Exchange Online). The presence of a Network Message ID confirms that the service processed the messages independently. However, email header analysis has its limitations, while it can confirm that the messages are not duplicates, it cannot determine what triggered each send action such as user action, application or automation. 

For deeper analysis, we recommend checking server-side data such as Message Trace and audit logs. These require administrator access in Microsoft 365. If you hold the Global Admin role in Microsoft 365, you can also submit a support request directly through the Microsoft 365 admin center. The support team can provide guidance and conduct further investigation, though please note that full root cause analysis may be outside the scope of standard support. 

For more details, please refer to Support limitations for issues with Microsoft 365 Apps - Microsoft 365 Apps | Microsoft Learn. 

Additionally, this is only an assumption based on the details provided. If it doesn’t match your situation, could you share a bit more information to help us narrow things down? For example: 

-Is the affected account a Microsoft personal (@outlook.com / @hotmail.com) account, or a work/school account (@onmicrosoft.com/ @domain.com)? 

-What type of account is configured in Outlook (POP, IMAP, or Exchange)? 

Please know that while our initial response might not resolve the issue right away, your input is incredibly valuable. With a bit more detail, we’ll work together to find the best solution for you.   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

The behavior described indicates two distinct send events rather than a client-side duplication issue. A deeper root cause analysis should focus on:

1. Confirming who/what sent each message
   Use the full internet message headers of both copies and analyze them with a header analyzer:
   • Obtain the full headers from Outlook (recipient’s copy is best).
   • Paste each header into a tool such as Message Header Analyzer in Microsoft Remote Connectivity Analyzer and select Parse.
   • Compare:
     • Message-ID / Network Message ID values (already known to differ).
     • From, Sender, and Return-Path to confirm the sending identity.
     • Received hops to see:
       • Which system first injected the message (e.g., on-premises Exchange, Exchange Online, a third‑party app, or device).
       • Source IPs and hostnames to identify whether a specific device, connector, or application is responsible.
2. Checking for automated or application-based sends
   Because the content format differs (subject/body vs. attachment‑only), investigate:
   • Any applications or services that send on behalf of the mailbox (CRM, scanners, line-of-business apps, mobile apps, EWS/Graph-based tools).
   • Whether those apps are configured to resend or schedule follow‑ups (e.g., a February send and a March resend of the same attachment).
3. Correlating with server-side logs or message trace
   If the mailbox is in Exchange Online or Exchange Server, use message tracking/message trace to see:
   • Exact submission time and source for each message.
   • Whether both messages originated from the same client IP/connector or different ones.
     This will confirm whether the second send was user-driven, app-driven, or triggered by a server process.
4. Verifying client behavior in Outlook
   Since this is Classic Outlook for Windows:
   • Confirm whether any Outlook add-ins (mail merge tools, automation add-ins, security tools) could be generating a second send with a different format.
   • Check the user’s Sent Items and any rules that might forward/redirect via another process (though different Network Message IDs indicate true re‑submission, not just copying).
5. Comparing header details for anomalies
   In the header analyzer output, pay particular attention to:
   • Authentication results (SPF/DKIM/DMARC) to ensure the messages are not spoofed.
   • Any signs of forwarding or re‑routing that could indicate a third party resending the message.

If, after header and trace analysis, both messages clearly originate from the same internal system or app at different times, the root cause will likely be in that system’s logic (e.g., retry/resend behavior, scheduled batch sends) rather than Outlook itself.

References:

• Message Header Analyzer
• Phishing investigation
• Email nondelivery reports and SMTP errors in Exchange Online