Identify the permissions
Mailbox access, Send As and Send on Behalf are distinct permission concepts. Record the permissions applicable at the relevant time, not only the current configuration. An administrator's present screenshot may not establish who had access months earlier. Service accounts and authorised integrations can also form part of the source map.
Correlate available activity
Where available, authorised audit records may help distinguish recorded actors and actions. Compare them with messages, sign-in information, device evidence and known working arrangements. Check retention and coverage before interpreting an absent event. A logged account identifier does not by itself establish the human operating that account.
Frame the conclusion carefully
For a fictional accounts@example.com mailbox, the proper question may be which authorised accounts could send and what records support the disputed event. It may remain impossible to attribute authorship conclusively. Preserve the competing explanations and separate access capability from observed activity. Instructions should cover the relevant custodians and account relationships while respecting scope and potentially privileged material. Report any collection action that changed mailbox state or generated new audit entries.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.