KB06042401 Monitoring an account
You believe an individual is using their account for non authorized purposes and would like to track incoming and outgoing mail.
Set up a User and Mailbox called <monitor>
Tracking Incoming Messages
Tracking incoming mail to the User is simple. You can use the Copy feature
described here: http://www.mailtraq.com/667/
to send a copy of all mail received by the User to <monitor>
Tracking Outgoing Messages
Tracking outgoing is a bit more involved.
Use the 'Forward a copy of .... shown here: http://www.mailtraq.com/701/
to send a copy of all outgoing mail to <monitor>.
If you are already using that function to send a copy of outgoing mail to a mailbox then make <monitor> a mailbox alias of that destination like this: http://www.mailtraq.com/668/
Now set an inbound mail filter in <monitor> like this:
to exclude all mail except that From: or To: your User.
Note the Config Tip at the bottom of that page.
You will then be able to webmail into the <monitor> account and see what they have been sending and receiving.
This method can be used to monitor more than one account at a time by creating different monitoring User accounts <monitor-jsmith> and <monitor-jdoe> and so forth.
Consider what retention policy you want for archive purposes to avoid needlessly consuming storage space.