Assuming your CEO is using a Windows based computer, I would start with an inspection of his or her machine. Although Anti-Virus isn't a perfect defense against Malware, it is a good seat-belt. You will want to ensure that Anti-Virus is installed, running, and up-to-date with the latest definitions. Do a full scan and see if that yields any results. If so, analyze the results using Google (i.e., Google the name of the Malware found on his or her machine) and see if the Malware is a contributing factor to the behavior you are seeing.
If you are comfortable with a packet sniffer, like WireShark, perhaps you could monitor traffic originating from the CEO's machine to see if you detect any command & control traffic or any other suspicious activity before, during and after he or she sends an email. Assuming your CEO is using a Windows based computer, there are several steps you could take to detect and analyze Malware on a live system by reading the first few chapters of the Practical Malware Analysis book.
If you are not comfortable with any of the above solutions, you could try a process of elimination test, where you give the CEO another computer and have him or her send emails from there. If the problem persists, you can at least rule out Malware on his or her computer.
A second place to look would be your mail server. Similar to detecting and analyzing Malware on a Windows computer, there are a few steps you could take on a Linux based machine by reading a few chapters of the Malware Forensics book. I hope this helps, if you like I maybe we can connect on IM and I can give you more information.