Does Zimbra log *forwards* of messages?

[Baylink]

I have an "ex-employee heard something they weren't supposed to" situation to clean up, and I haven't found anything in the logs yet that suggests the server was broken into.

Is there any *easy* way to determine that a user forwarded a message from their mailbox, without looking through every single sent box?

[Krishopper]

Short answer: No.

A forward (and reply for that matter) are simply new messages injected into the system, so you would probably have to do some digging into the users mailbox(es) to actually see what happened.

[Baylink]

Short answer: No.

A forward (and reply for that matter) are simply new messages injected into the system, so you would probably have to do some digging into the users mailbox(es) to actually see what happened.

Well, they are that from *postfix's* point of view, certainly, but *the web client* knows what it did. What the issues are with ZCO and ZMobile, I'm not sure; I know POP and IMAP connections it couldn't figure it out on.