There are two items I have been unable to identify the appropriate log for.
1) Determining who and how an email was sent. In the Transport Logs, I can see the smtp log but it does not show me which account was used to send the message when the sender address is not correct (forged) . It shows the IP of the mail server but I have no way of tracking down which account was used to authenticate.
2) When a message is bounced due to size, I'd like to get the size of the bounced message because third parties often refute the attachment size later or there is great difficulty obtaining this information and some documents are sensitive and difficult to get resent. I'd like to pull up a log and have proof that a bounced message was X size.
