According to your description, the blank Internet mail header means that the mail has not been routed through exchange, and it is possible that the sender of malicious mail obtained the password of the company personnel through other tools and directly wrote the mail into the inbox; In addition, through the management tools of exchange2003, you can query and track the routing information of incoming and outgoing emails in the system, and you can also query the contents of emails to determine the source of malicious emails.