I'm tasked with sifting through a "marked" users email to locate any "wrong-doings" and could use some advice on how best to go by this. It appears this user has caught on to what's going on and has began deleting anything that isn't company related. Is there anything I can do on the exchange server to obtain any and all email transactions performed by this user? I know the users password so I can log in as them and view their existing email as it sits on the exchange 2000 server. Thanks