Build an inventory of server-side forwarding configured across the mail platform.
For each forward, identify:
- source mailbox;
- destination;
- internal or external;
- who configured it where logs permit;
- business owner;
- whether a copy remains locally.
Review external destinations more closely and compare them with organizational policy.
During incident response, also inspect inbox rules and application/OAuth access because forwarding can be implemented through more than one feature.