John, the domain level Automated Forwarding toggle should disable it for all users as it would disable the functionality at the domain level. That being said, I wonder if they might be detecting email that is being forwarded by way of events or content filters? Do you know if they might have this setup?

No rules/filters are on any of the accounts.

Thanks for your follow-up John. This would indicate that either users are manually forwarding emails to this host, or the host may be interpreting standard traffic as forwards. Can I have you submit a ticket on this one so we can help get to the bottom of it? In the meantime, here's how you can determine whether or not you still have users with Automated Forwarding enabled:

1. Navigate to Manage>Troubleshooting>View Logs
2. Change the log type to Delivery and enter a search string of 'yahoo.com' or the domain you're trying to narrow down. Change the Type to Display Related Traffic. Click Search
3. Using the keyboard shortcut of Cmd/Ctrl + F, do a browser find for "Forwarded Delivered" (This line indicates that the user has automated forwarding enabled.)
4. Using the browser Find functionality, step through each instance of (Forwarded Delivered) and review the logging session to determine if the automated forwarding is going to Gmail.com/Yahoo.com/etc.

Note: Each delivery session has its own session ID (enclosed in brackets), so you can determine which deliveries are related. If you need to break down an individual session, enter the session ID into the Search string. You can then use the browser Find option to locate recipient addresses on that specific session.

5. To verify that a user has Automated Forwarding  to Gmail/Yahoo/etc enabled, you can impersonate the user and look at their Settings>Account>Forwarding card.