You can enable mailbox audit logging to track logons to mailboxes and determine which actions are being taken against a mailbox. Audit log entries for a mailbox keep track of important details such as the username, client IP address, and hostname of the computer used by the person that made the change, and the actions made, such as accessing, moving, or deleting messages. In this recipe, we'll look at what needs to be done in order to enable and configure mailbox audit logging.
Set-Mailbox -Identity dsmith -AuditEnabled $true
AuditLogAgeLimitproperty, which, by default, is ...