Check DNS Records for spoofing
Proxy traffic via Linux box
Check Exchange domain name
Finding on-prem Microsoft tools
Username enumeration