на реддите во какие страсти: Yes, I'm seeing this now. Following the logs I found while we're updating, basically they did this, maybe automated as each log is only within seconds of one another:
Hit autodiscover as SYSTEM and resolved the domain admin account by SID to get the email address of it (I think, it's not clear at the moment but it makes the most sense to me right now).
Then they hit MAPI and tried to give LOCALSYSTEM (SID S-1-5-18) ownership of the domain admin mailbox, which resulted in an error and stack trace basically saying you can't do that.
Then they hit ECP and did "something" with either a drop or a request for
myhost.mydomain.com/ecp/y.js (it wasn't there when I checked) through /ecp/proxyLogon.ecp.
Then in /ecp/DDI/DDIService.scv, queried for the OABVirtualDirectory using the same y.js in the ecp virtual directory which looks like probing similar to the above.