My AD guy is questioning why this test account is one of the highest hitters for authentication requests to our Operations Master servers. I can't imagine that my operations guys are running that many powershell test-xxxx commands all day long, so I am making an educated guess that regular Exchange monitoring / health checks, along with SCOM monitoring, use the test-xxx commands or derivatives of and these monitoring process are therefore using the extest_ mailbox and causing what is being questioned as an excessive amount of authentication requests.

Would this be a valid assessment?

Thanks!  Tom

Your explanation is what I would assume to be correct.