@scottalanmiller said in Office 365 Moving Emails to Deleted Items:
Outlook might not have the rules, Exchange might. We've seen this a lot and it is caused when users use Outlook rather than OWA and don't know that they have client rules that they normally play with and more important server side rules that Outlook doesn't show you. That's how they get hidden.
I've gone through the rules with both PowerShell from the admin side, and both Outlook and OWA in the User's account side. The only rule that deletes items is working fine.
Pretty commonly it is a "password reset" attack vector, and this is to hide the password reset emails being received.
By this, you mean the rule is hiding "we're attempting to change your password" type emails?
If those emails were set to be permanently deleted, they could still be recovered form the "Recover deleted items" section in the Deleted Items folder. The only thing we're finding there is the messages that have been deleted.