I haven't been able to find any documentation on this, but I need to
find out what logs I need to look at to determine who sent an email to
an external user.

We have experienced a bit of a security issue with an email being
forwarded out of the system, but having a hard time knowing who sent
it. I see the message going out of the system, but can't tie it back
to a user.

If anyone can point me to a TID or other information that would be
very helpful!