Are you able to get them to forward one of these mails back to you as an attachment and look at the headers of said mail (preferably by downloading it from webmail and not Outlook (Outlook has an annoying tendency to mangle the headers).
Only use Helpful answer if your problems been solved.
Received: from VI1PR08MB0861.eurprd08.prod.outlook.com (10.152.12.55) by VE1EUR02FT025.mail.protection.outlook.com (10.152.12.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1580.10 via Frontend Transport; Thu, 31 Jan 2019 19:46:11 +0000 Received: from VI1PR08MB0861.eurprd08.prod.outlook.com ([fe80::c15e:af69:7675:8e91]) by VI1PR08MB0861.eurprd08.prod.outlook.com ([fe80::c15e:af69:7675:8e91%2]) with mapi id 15.20.1558.023; Thu, 31 Jan 2019 19:46:11 +0000
So looking at that, I'm guessing it's outlook which has sent them out?
I've taken a look at the outbound mail log data and see only a single email sent out on the 31st January, from a Microsoft (Outlook) IP address. The subject last word is 'era', does this sound familiar?