We use a hosted archive solution and when recovering an archived message find "today's" date on the message rather than the original date. The vendor is spoofing the date and time stamp to reflect the original date\time when it leaves the vendor. We can verify that is leaves our external proxy with the correct original date, yet ends up in Exchange with today's date and time.
This thread was automatically locked due to age.