As part of your security protocol, you may wish to audit user mailboxes for rules that deliver messages to external recipients.  You can use this script to collect that data.

Update:

This script checks user mailboxes for rules that match the following:

If detected, those rules are saved in an audit log for further review.  You can use this script against either Exchange on-premises versions that support Get-InboxRule (Exchange 2010 or later) or Exchange Online.  You must have at least Recipient Management permission for this cmdlet to work.