I asked one of the techs in my office and she said:
"To trace a specific email you could track by device email address, PIN
or by the mailbox username. If the approximate time range is known then
you can match the Tag Ids in the log line to follow the email through
the logs. You cannot audit an email based on recipient addresses or
email subject."
We will be releasing features as part of our next version of
NeedTEXT Monitor to help specifically with these cases, i.e. searching and monitoring the BES logs for specific strings and events. Private message me if you want more info on that.
Good luck!
Log files
