Exchange 2013 Hidden Forwarding Rule

Encountered a strange issue on Exchange 2013 that at this stage I think is potentially a bug. Essentially there was once a forwarding rule (implemented via PowerShell) in place for a User's mailbox that now I can't see nor disable, via PowerShell or the UI.

Rough timeline of events:

• We had an ex-employees mailbox (john@domain.com) with a forwarding rule implemented via the usual PS command at their time of leaving
Set-Mailbox -Identity "John Doe" -DeliverToMailboxAndForward $true -ForwardingSMTPAddress "oldemployees@domain.com"
• A new employee called John joins the company
• I rename all aspects of the old employees account and mailbox to johnd (so their alias, pre-2000 login, account name, email address) – forgetting to first remove the forwarder
• I add a new mailbox and user for the 'new John', using john@ for address, john for alias, and so on
• The forwarding still takes place, but Exchange doesn't list any such forwarder on any mailbox.

I've tried all the commands/approaches I can think of and spent a good two hours looking for a resolution:

• Nothing listed/set with Get-Mailbox <identity> | fl ForwardingSMTPAddress,DeliverToMailboxandForward on either mailbox
• I've tried listing/interrogating all other mailboxes with a forwarding address implemented, nothing there either: Get-mailbox | select DisplayName,ForwardingAddress | where {$_.ForwardingAddress -ne $Null}
• I've tried setting both mailboxes to have no (or $Null/$False) forward address, forward smtp address, etc even though I can see none are set (and running the command(s) it confirms that nothing has been changed as a result)
• I've looked at each user account and any relevant object I can think of within ADSI Edit and see no mention of it
• I've swapped the users back (i.e. reverted usernames, alias, etc) and checked that the rule didn't then 'reattach' or reappear on the ex-employees mailbox, but it didn't
• I've checked rules in Outlook (there are none) and also started Outlook with the /clearrules and /clearserverrules flags

Weirdly, if I set a new forward rule via the UI, that then takes precedent over the hidden rule/config. But if I remove that rule, it goes back to forwarding to the old address.

Really at a loss as to how to solve; it's almost as if the rule has become detached from the mailbox layer but somehow managed to stick on the transport layer. I've also tried the fix all (reboot).

Any suggestions or pointers welcomed