One of the email account has been probably misused to send manipulated. The admins cannot find out the sender device IP address. The IP of original sender isn't visible. The sender IP is Exchange Server IP.
Messaging Gateway
Messaging Gateway cannot see beyond the source IP of the Exchange Server
It is strongly recommended consulting Microsoft support if the client needs to investigate further who sent these messages.