1. Log in to SmarterMail as the system administrator
2. Go to the Reports area
3. Expand System Summary Reports, then Traffic Reports
4. Click on Message Traffic
5. This report lists all domains on the mail server, and also displays the total incoming and outgoing messages for those domains. The domain with the compromised account will more than likely be the one with the most outgoing messages.
6. Click on the domain you suspect to have the compromised account to display all of the users of that domain. Again, the one that is compromised is more than likely the one with the most messages sent.
7. Click on the user to take a look at their message traffic from the past week. Generally, you’ll see a large increase in outgoing messages that will probably coincide with when the account was hacked.