Can’t find how to remove forwarding

I would bet that the issues you're experiencing are related to the way that the POP3 connector for Exchange works, and the fact that you're using a catchall mailbox.

You mention that you're using a catchall POP3 mailbox - can you look at this remotely before you pull the mail down? You might find there are three copies of the same email copied to three different people. Since there are no individual mailboxes for those recipients, they all get dumped into the same mailbox.

As as aside, I would avoid using the POP3 connector because BCC recipients don't work with it when a catchall mailbox is involved.

Can you switch to one mailbox per user, or maybe host your own MX?

Yes, the MS model is very much centered around delegated trust. There are going to be super-users, and it is up to the Organization to manage who can see what, where. Engineering a system like you're looking for using Exchange will require some out-of-Exchange business practices.

• Domain/Enterprise Admin accounts are not used. Such accounts are only broken out for very specific, and well logged, circumstances. These are the God users who can read and see everything.
  • Such actions are performed under the fly-with-a-friend rule. Anyone using such accounts will do so only with someone else there to watch.
  • Security EventLogs are tracked and admin-account usage cross-checked with approved usage. This critical audit step will help catch mis-use of elevated credentials.
• Admin users are delegated the rights they need, and no others. This is hard, as Domain Admin is so easy. But Admin users, such as ourselves, do not run with God rights. During setup, our accounts are delegated the rights we need to do what we do.
  • Sometimes one of those rights is: permitted to submit a request for elevated access under these specific circumstances.
• The Exchange organization is broken in to trust zones with local admin users. The group dealing with SEC communications has their own Mail Admin, who may have extended rights in to the relevant user mailboxes. This person is inside the trust-boundary for this internal organization.
  • Yes, this does create a lot more Exchange admins. But that's what happens when centralization is not an option.

Yes, Microsoft really does expect an organization to hold users with elevated privileges to a higher standard of behavior. This is because so much of our routine work requires exposure to private data. If those takeover negotiations are subjected to Legal Hold, we need to get in there and set that up. If the CEO is having trouble getting their iPhone talking with Exchange, we'll be the ones figuring out why.

At my old job where I was such an Exchange admin, we had to sign several agreements relating to privacy policy, impersonation, and penalties for failing to comply with same.