We recently discovered that one of our mailboxes was missing an important email alias, because the person that did our marketing forgot to ask for it to be created.
Is there any way in Exchange that we can track any emails that may have been sent to an un-known alias? They all received a 550 5.1.1 User Unknown
NDR.
I don't expect to know what the content of the email is, but even just the number of requests would be great.
Probably the best method for tracking that down would be the transport/message tracking logs on the hub servers.
But, they automatically rotate (I believe the default is 30 days) - do yours go back far enough to cover the timeframe that you're interested in?