I work in a small company in Thailand, SE Asia. I am originally from Europe. I live and work there since many years, we all speak English in the company, and normally communication works fine.
I am responsible for IT and IT security.
Some time ago a hacker tried to hack our email accounts. Since then I check regularly all email activities from all users (I don't see the body of the emails, just the header). I check when each user (tried to) logon to which email account from where (IP address) and when. I look for multiple failed login attempts, unusual locations (IP addresses), etc.
If I find something strange like i.e. logon attempts from a different continent I ask the relevant user(s) if they have any idea how this could have happened. I.e. maybe they opened an attachment with a virus but they didn't think anything bad happened, so they didn't report it. Or maybe they downloaded something bad or something like that. Or maybe the users didn't do anything unusual and the hacking attempt is random.
My intention is to find out what happend and to make sure nobody hacks our system. But when I see something strange and ask users if they know why this might have happened then some users, especially one woman, think I accuse them of doing something illegal like giving out her password.
I try to make sure everybody understands that I don't accuse anybody. I just try to find out what happend. We all make mistakes from time to time and if a user opened i.e. a bad attachment then I want to know so that I can minimize possible problems. But it seems some people think I accuse them, however I formulate my request for information.
How can I make sure users understand that what I do is in the interest of everybody and in the interest of the security of out email system and reputation of our company.
I have the support of the boss. But obviously it would be good if people don't misunderstand my intention.