Lots of emails

We have recently had reported a number of emails (according to one report over 100 received) have been sent to users/learners on our platform. We are not sure how to investigate how this happened or what triggered this. Any help with how we would go about looking into this would be appreciated

Secondly the emails appear to be coming from our old company version of the email address, This email address is an alias, and the UPN of a shared mailbox however the primary SMTP is the new company domain version.

We are not sure if this has recently changed somehow or never been setup with the newco email, which would be a surprise as we have only started using bright space since being newco name.

Some help to investigate if a change took place or if this was always set to use the old version.

DNS Setting are in place already and have been for several years from what I can see (based on the order of spf records in the list.)

Any help with investigating and looking into this greatly appreciated.