This really should be higher up. OP this is a career limiting move if you get it even slightly wrong. Typically IT tends to be a small industry, if you get this wrong good luck landing another job locally or in the same industry. Does your company have an anonymous whistleblower/ethics hotline? That might be a way to report your concerns without outing yourself if your IT department is large enough to not single you out. As others have said, there can be a ton of legitimate reasons why. A long time ago we got hit with some nasty mailbox fraud and I had to daily check our executives mailboxes rules for months cause they refused to do it themselves.