Mailbox forwarding
Mailbox forwarding automatically sends incoming email onward to another address through a mailbox setting or mail rule, with the scope and handling of the original message depending on the configuration.
A useful feature can send mail to the wrong place
Forwarding can serve an approved business purpose. It can also let someone keep receiving correspondence from a compromised mailbox. MITRE documents attackers using forwarding rules to collect mail, including rules that select messages of interest.
In Exchange Online, administrators can configure mailbox forwarding and users can create Inbox rules. The configuration determines which messages move and whether a local copy remains. Seeing a message in the original inbox does not prove that no copy went elsewhere.
Forwarding is different from delegation. A delegate receives permissions to work with a mailbox; forwarding sends messages onward. The delegation article explains why reading and sending permissions need their own review.
A saved rule is not proof of delivery
External forwarding controls can block a message even when a destination has been configured. Microsoft documents outbound spam policies, remote-domain settings, and mail flow rules that can affect the result. Check the controls that apply to the mailbox and destination, not just the rule screen.
Message trace can help establish whether Exchange Online received, rejected, deferred, or sent a particular message. Follow the status and destination; do not turn a configuration change into a claim that every message was delivered or read.
When reviewing an unexpected rule, establish who authorized it and who controls the destination. Removing an abusive rule stops that forwarding path from continuing, but it does not retrieve copies already sent. The external-forwarding article follows approval, delivery evidence, and removal in more detail.