I figured out what had happened here. It turns out someone had cloned the SQL sever without my knowledege and that new server was the one sending the emails. The syntax of messages between the two servers was identical which is why I thought it was coming from the orginal.

Thanks for your input, Lynn.