Software

It is probably some Spammer using the persons address. There is not enough information to trace who sent it. It could also be a spammer validating addresses. Tell the person, that if they did not send to that address, to just ignore it.

If these responses are to legitimate emails they sent, then it could be the type of attachment they included (or information in the email) is setting off a spam/security trigger on the receiving system. This is even more frequent now as companies outsource their email filtering.

If they never actually sent a message to that recipient, this is generally a result of a virus or malware spoofing. What is likely happening is that someone who has your employees in their address book has malware on their system and is broadcasting spam or messages with virused attachments etc. These are being blocked by others security filtering and the response is being sent back to the spoofed address of your employees.

You may be able to discern some helpful information by looking carefully at the email headers. Good luck....hope this helps.