Web mail intercepted! How?

[pagoda33 () sbcglobal net]

Someone at our company sent email using a free Web mail service from a workstation inside our network. The message was 
somehow intercepted by a third party, was forwarded to an unknown number of people, and found its way back to the 
sender...

Needless to say, the sender is quite upset ...

We don't know whether the Web mail account was compromised from the outside, or if someone is packet-sniffing or 
keylogging from inside the network.

We're going to start looking tomorrow... any ideas on how to proceed?