Shell Script command to track messages
Get-MessageTrackingLog -ResultSize Unlimited -EVENTID receive -MessageSubject “***INFECTED***”
Get-MessageTrackingLog -ResultSize Unlimited -EVENTID receive -MessageSubject “***INFECTED***” | Select-Object timestamp,ServerHostname,ClientHostname,Source,EventId,Recipients | Sort-Object -Property Timestamp >> c:\steve2.txt
Get-MessageTrackingLog -ResultSize Unlimited -EVENTID receive -MessageSubject “***”
Get-MessageTrackingLog -ResultSize Unlimited -EVENTID receive -MessageSubject “***” | Select-Object timestamp,ServerHostname,ClientHostname,Source,EventId,Recipients | Sort-Object -Property Timestamp
https://technet.microsoft.com/en-us/library/bb124926(v=exchg.160).aspx