Does the transport record prove the mailbox was deleted?

No. It proves the delivery behavior of the address changed between June 23 and July 14 and changed again by July 29. Only the county tenant’s audit, lifecycle, retention, and eDiscovery records establish mailbox state and content preservation.

Does it identify who caused the change?

No, and the packet says so expressly. The administrator audit log inside the county tenant would.

What does 550 5.1.10 RecipientNotFound mean?

It is a Microsoft Exchange rejection indicating the recipient address could not be resolved to an existing mailbox object at the receiving organization.

What does 550 5.4.1 Access denied mean?

It is a Microsoft Exchange edge rejection indicating the receiving system refused to accept the message for the specified recipient, typically on policy or permission grounds rather than nonexistence.

The Prosecutor’s County Mailbox Answered on June 23. By July 14 It Did Not Exist. By July 29 It Refused Mail Outright.

Authenticated Microsoft transport metadata records one successful county auto-reply followed by two different rejection codes for the same address — all during active litigation and a served preservation demand.

email transport metadatamailbox preservationMicrosoft 550Francis DeRosa

What the Record Establishes

On June 23 the address existed and answered automatically.
By July 14 the county mail system reported that the recipient did not exist.
By July 29 the county edge refused the message on access grounds.
The change happened during active litigation, after preservation demands were served.

What They Have Not Produced

The Microsoft 365 Unified Audit Log: which administrator account changed the recipient object, and on what date.
Entra ID lifecycle events, mailbox state, retention policy, and litigation-hold status for the account.
Whether an eDiscovery hold preserved the historical contents, or whether nothing was holding them at all.

An email address does not quietly stop existing in the middle of a lawsuit about the emails inside it. On June 23, 2026, the county address for Assistant State’s Attorney Francis DeRosa generated an authenticated Microsoft automatic reply, linked by message ID to the outgoing message, 101 seconds after it was sent. On July 14, the same address returned 550 5.1.10 RecipientNotFound in nineteen seconds. On July 29, the county edge returned 550 5.4.1 Access denied in fifteen seconds. Raw headers, hashes, and rejecting hosts are preserved in a seven-page metadata packet.

What the transport record fixes in time

Something changed the recipient resolution or the recipient object between June 23 and July 14, and something changed the access posture again by July 29. Two different codes, two different failure modes, one address. That is not ambiguity — that is a dated change to a custodian’s mailbox during a preservation period.

What this page will not do

It will not tell you DeRosa deleted his mailbox. The transport record does not identify an administrator, a policy, a separation event, or a lifecycle action, and it does not establish that historical contents were destroyed. Anyone who tells you otherwise is reading past the evidence.

Here is why that restraint is the sharpest available position

The records that would explain this benignly all exist, all sit inside the county’s own Microsoft tenant, and all can be exported in under an hour: the Unified Audit Log, Entra ID lifecycle events, Exchange mailbox state, retention policy, litigation-hold status, forwarding rules, eDiscovery preservation, administrator audit events. A county with an innocent explanation produces them. Lake County has produced none. The July 30 preservation referral asks a federal agency to secure them before the answer becomes unavailable.

Open the dossier for the prosecutor whose mailbox is at issue.