Users T and S received an email.
User S has proxy access to T's mailbox and forwarded the email to himself.

Looking at the forwarded email in T's Sent Items:
1. the only visible recipient is S. Looking at the properties the email has been sent to many people, internal and external (looks a lot like the whole of S's Frequent Contacts address book).
2. hovering over S's name in the To: field displays 'givenname surname.gwpo.gwdom' instead of the usual smtp format address and additional details.

One of unexpected recipients replied (from a Blackberry) and the subject line has some additional unicode characters (in HTML view they look like chinese).

Please can someone advise how we can find out:
1. How the additional recipients get added to the email?
2. How the additionall text got added to the subject line?

Thanks in advance