Avast would scan outbound email to see it was clean, but what it can't do is say if this was an email sent by the user.
If it was actually sent from his computer (and MS Outlook) surely there would be a copy of these emails in the sent emails folder, if they originated from his system ?
Otherwise it could be email spoofing as suggested.
That said spoofing emails are also likely to be scam/spam orientated, which only the recipient could attest, hence the confusion mention.
The only reason he found out, was because one of the contacts that received the forwarded email, replied with confusion
Without getting into details on this confusion, did this email appear to be a scam or a phishing attempt (link to a site purporting to be another), etc. ?
No - the email was not phishing attempt. I would call it spam I suppose. Forwarding a letter to random contacts, for the heck of it?
1. My father reads an email in his Inbox - normal correspondence with a friend. (Email #1)
2. He leaves the house to run errands.
3. He comes back to house an hour or so later, to read a new email from a different contact from his address book(Email #2), wondering why my father would 'forward' an email that didn't pertain to them.
4. He looks in his Sent mail, only to find that sure enough - supposedly he had forwarded this (Email #1) to 2 contacts from this address book.
5. Unfortunately he panics and deletes the email, not only from the Sent mail, but also from Trash. I wish he hadn't, so I could have had a good look at it, including any possible cookie crumb trail like IP address or who it's really from.
6. Emails me wondering what to do. At that point I go over and run a full Avast boot-time scan. He also changes email pw. Again - I'll for sure update this with what AVAST found and quarantined.
I've advised him to run a full scan every week now, on a Sunday for example. Also, to change pw from time to time.
There's no phishing, financial queries, numbers of any sort. Nothing to gain from forwarding this email aside from a weird surprise. '
---------------------
By the way, thank god for audio verification option - I can't read the damn letters that I'm supposed to type lol.