How to Enable Mailbox Auditing
Mailbox Auditing allows you to track the sending and receiving of email messages, intended targets, and subject line text. Please note, due to the way that Microsoft Exchange logs information to the tracking logs, the Mailbox Audit reports display the recipients list as it is created by the mailbox user. Any distribution lists that are included in the recipients list are not expanded to include all members of the distribution list. If a mailbox that is being audited receives a message that was sent to a distribution list, the received messages list does not indicate that the message was sent to a distribution list rather than directly to the mailbox.
Note: The list of mailboxes that appears in the mailbox auditing functionality is populated by the mailboxes that have been gathered from the Exchange organization and stored in the MessageStats database
Note: After you have selected the mailboxes to be audited, the information does not appear in the reports until after an Exchange Tracking Logs gathering task has run successfully. The Exchange Tracking Logs task is part of the Default gathering task, but it can also be run separately
NOTE: If more mailboxes are added to your Exchange enviroment they will not be dynamically added to auditing, you will need to add these manually.