Mo Farah was apparently​ suspected of doping on one occasion by an expert enlisted by the IAAF, the athletics world governing body, after his biological passport flagged up unusual results.

But the documents suggest the International Association of Athletics Federations was later satisfied that the four-times Olympic champion was running clean after further testing. The athlete biological passport (ABP) was introduced in 2009 by the IAAF and is a next-generation test, analysing results over a period of time for the effects rather than presence of drugs.

The latest leak from the Russian hackers Fancy Bears has revealed what appears to be an email from Pierre-Yves Garnier, a senior doctor in the IAAF’s anti-doping department, to Kyle Barber, an IAAF out-of-competition testing coordinator and Thomas Capdevielle, a senior anti-doping manager at the organisation.

The IAAF said on Wednesday night it was investigating the leak but that the email and the attached documents were likely to have been stolen in a cyber-attack in April. “We are looking into this. It does appear to be information from the cyber-attack which the IAAF announced on 3 April, 2017 had taken place,” a spokesman told the Guardian.

Farah is listed in two spreadsheets attached to the email, which appears to list a number of names of athletes next to their ABP results.

In one file, beside the 34-year-old’s name and under the headline “hematological expert opinion” is the comment: “Likely doping; Passport suspicious: further data is required.” That assessment was apparently based on the results of testing over an extended period of time with the last test having been done on 23 November, 2015. A second database, attached to an email dated April 2016, however, records “now flagged as normal with the last sample”.

The email from April 2016 appears to put Farah in the clear, with Garnier stating he was one of two athletes previously under suspicion whose ABP results “very recently became ‘normal’”. Farah has always vociferously denied ever taking performance enhancing drugs.

A spokesperson for Farah said on Wednesday night: “It has been widely reported that previous leaks from this organisation have included false or altered documents, and we have asked the IAAF to urgently look into the validity.

“Regardless, any suggestion of misconduct is entirely false and seriously misleading. Mo Farah has been subject to many blood tests during his career and has never failed a single one. We have never been informed of any of Mo’s test results being outside of the legal parameters set by the relevant authorities, nor has Mo ever been contacted by the IAAF about any individual result. It is totally incorrect and defamatory to suggest otherwise, and we will pursue any claims to the contrary through all necessary legal routes.”

Alberto Salazar, Farah’s coach since 2011, remains under investigation by the US Anti-Doping Agency and this probe is believed to be reaching its conclusion. A leaked interim Usada report was also put into the public domain earlier this year by the Fancy Bears hackers, a group believed to be motivated by revenge for the way in which systemic state-sponsored doping in Russia was uncovered.

The report suggested the Cuban-born Salazar had failed to establish a valid reason for possessing testosterone and committed “unlawful” behaviour by rubbing a gel containing the banned substance on his sons. The report also raised “suspicions and concerns” about Salazar’s practice of giving Galen Rupp, Farah’s training partner, massages before big races, despite Nike employing massage therapists. Salazar has denied any wrongdoing.

Salazar has always maintained his innocence, and issued a ferocious 12,000-word rebuttal to many of the allegations against him in 2015. In March, when the full leaked Usada report emerged, he released a statement which said: “I have clearly and repeatedly refuted allegations directed against me and the Oregon Project. I believe in a clean sport and a methodical, dedicated, approach to training. The Oregon Project will never permit doping.”

In April, the IAAF confirmed it had been the victim of a “cyber-attack” by ​the Fancy Bears in​ February and said it had called in security experts from Monaco and the UK to shut down the attack.

At the time, the IAAF said it looked like the Fancy Bears were trying to access the database on which it stored its therapeutic use exemption (TUE) records - the doctors’ notes which allow athletes to use medication which would be otherwise banned by the World Anti-Doping Agency (WADA).

This was the same tactic the group used to reveal that Sir Bradley Wiggins was given permission to use a powerful corticosteroid before his three biggest races in 2011, 2012 and 2013, including his 2012 Tour de France win.

A statement issued on Wiggins’s behalf at the time said: “There’s nothing new here. Everyone knows Brad suffers from asthma, his medical treatment is British Cycling and International Cycling Union approved and like all Team GB athletes he follows Wada regulations to the letter.”