Possible causes of this issue are:

1. Any SMTP address, alias or display name for the employee who should not be captured in the search is present in the properties of one of the Department's monitored employees.
2. The SMTP address for the incorrectly captured employee is being found by the search due to the way in which the indexing engine parses an address belonging to one of the monitored employees.
   1. For example, the incorrectly captured employee has the SMTP address of 'john.m.doe@emailaddress.com' and one of the department members has the SMTP address of 'm_doe@emailaddress.com'. The search engine matches on the 'm.doe@emailaddress.com' portion of the incorrectly captured employee's SMTP address.

For Cause 1 above, remove the incorrect SMTP address, alias or display name from the monitored employee's properties.

For Cause 2 above, either:

• Change one or the other of the addresses, if possible, especially if the monitored employee is using a number of SMTP addresses (i.e., change 'm_doe@emailaddress.com' to 'mary_doe@emailaddress.com').
• Exclude e-mails to/from the incorrect user.  In the example above, to exclude 'john.m.doe@emailaddress.com' from being captured in a CA search, place the exclusion character (the '-' sign) in front of the incorrect user's SMTP address i.e., '-john.m.doe@emailaddress.com' without the single quotes) in either the "Freeform email addresses / domains" field or in the properties of the Monitored Employee with which the matches are occurring.