There are three ways to forward mail from one user to another in Exchange

1. Exchange Forwarding Most Common – Done by Administrator
2. Inbox Rule – Done by User
3. Hub Transport Rule – Done by Administrator

1 and 3 can be checked easily and there will be references of when this is done and not done usually in tickets , however users can enable Inbox rules by themselves then contact your later to disable the forward.

Here is how to check for forwarding or redirecting rules on mailbox in 365

 foreach ($i in (Get-Mailbox -identity %USERNAME%))
 { Get-InboxRule -Mailbox $i.DistinguishedName | where {$_.ForwardTo} | fl MailboxOwnerID,Name,ForwardTo }

  foreach ($i in (Get-Mailbox -identity %USERNAME%))
 { Get-InboxRule -Mailbox $i.DistinguishedName | where {$_.ReDirectTo} | fl MailboxOwnerID,Name,RedirectTo}

To Disable

Disable-InboxRule -Identity "%NAME OF RULE%" -Mailbox "%USERNAME"