If there is a general mailbox set up (i.e. customerservice@blahblah.com) that several users have access to, are you able to find out which user actually sent a particular message? I can see who was logged on during that period, but that does not narrow it down far enough to find out the culprit. The message tracking feature on exchange is not turned on so I cannot do it that way.