In Exchange Online users can forward their emails automatically to another email address. If this is to a personal external email address then this may not be secure or against company email usage policy.

To check if any of your users are doing so you can run the following powershell command:

Get-Mailbox -results unlimited -filter {DeliverToMailboxAndForward -eq 'True'} | select UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward

Auto forwarding can be blocked in the Exchange Admin Center. Go to "mail flow -> remote domains" and configure domain unticking "Allow automatic forwarding" option.