We have Sharepoint 2013 SP1 on premise with my company. I am the Sharepoint admin/All hats.
Yesterday thousands of Alert-me’s were send from a particular calendar. Upon investigation, the site and list have no workflows. The alert me’s were set to trigger upon any change. Version history reveals a specific user has someone “touched” all items in the a specific calendar list. In some cases 2 times.
I have no reason to believe that user would to this on their own. Over 7200 items were modified with her credentials. As I look at the version history, it does not reveal that a specific field was updated or changed. Sometimes Sharepoint version history will show the updated fields, but that is not the case here. Still somehow they were able to trigger this update for 99% of the items on the list. Thus the flood of emails and raised concerns.
So I am struggling to think how a user could update that many updates over the course of an hour. I know that in data sheet view you could, but that would leave a trace of some value changed. That is not the case here.
- They have contribute permissions.
- Content approval is off
- They do have the calendar linked to their outlook.
- They were one the site earlier that day and made one entry. During the time the updates were occurring, she was not using the site
Any ideas to point me in the right direction? This is not an easy subject to research on the web for possible answers.
Unfortunately no, we did not have audit logs enabled.
I have been watching the site via alert mes to try and see if it will happen again. Seems like a very random event, not sure if I can reproduce it not knowing the cause.
