Odd issue with message tracking. (User's emails show as SUBMIT and not SEND. No Byte Size) Exchange 2010

Question

Hi everybody.
I had been tasked with tracking down a user's emails.
I ran a script in powershell to export data I could work with.
For some reason this particular user's emails in this time range do not show up as the EVENTID "SEND".
They also do not have a Byte Count nor a list of recipients.
They only seem to show up as "SUBMIT"
Apparently this user has been sending out emails with a large amount of BCCs.
Is there any way to actually see this activity? Why would it be showing up as SUBMIT and not SEND? Why won't it show any recipients or byte count?
Here is my example script.
Get-MessageTrackingLog -ResultSize Unlimited -Server "contoso-ex1" -Start "5/1/2014 12:01:00 AM" -End "5/8/2014 6:40:00 PM" | Select Sender,{$_.Recipients},{$_.RecipientStatus},MessageSubject,TimeStamp, EventId, Source,SourceContext,MessageId,InternalMessageId,ClientIP,ClientHostName,ServerIP,ServerHostName,ConnectorId,TotalBytes,RecipientCount,RelatedRecipientAddress,Reference,ReturnPath,MessageInfo
| Export-Csv .\MessageTrackingLog.csv
Please note that only this one user's emails are showing only as SUBMIT. The rest are mostly SEND.
MCSE 2003, Exchange. MCTS Vista, 7. Administrator of awful, neglected website http://timssims.net

Answer 1

Hi,
I’d like to double confirm the question: This issue occurred only on one specific user in a particular time range.
In other time, the message tracking shows correctly information for this user.
I suggest we check the application log during that time range and see whether there are any related event IDs about this user.
Thanks,
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support