I've read that some managers prepare and issue invoices on the name of their clients to the company's AP to prevent delayed payments, if a tool is built to scan metadata then even such cases which may not be malicious may still get caught; although technically it may be still wrong according to company policies.