Just recovered an Exchange 2010 Standard server with GFI running on it. Two GFI services, MSExchangeMailSubmission and MSExchangeTransport services were all disabled. Hub Transport had to be removed and reinstalled, but email flow has returned.
After recovery, emails in GFI's FailedMail folder moved to TransportRoles/Replay and were reprocessed successfully. However, there are several emails for which are still unaccounted. I looked into message tracking and there is gap when hub transport was down. Our first step was checking through each users "Sent Items" folder in OWA. There were a handful of people who had many emails listed in the "Sent Items" folder, so we manually pushed each one out again. However, some users have empty "Sent Items" folders for the outage period. For example, one user claims he sent two messages during the outage - both to internal recipients. Both are missing from the "Sent Items" folder and both are non-existent in message tracking.
The two coincidences I see is that most users complaining about missing emails have Mac Office 2011 and most emails missing were just to another internal recipient. Are these coincidences or do they lead to finding these missing emails?
Can anyone help find these missing emails?