I need to know if anybody knows how I can trace any changes in msexchange server. I have a concern that someone is giving themselves rights to a different mailbox and reading e-mails intended for a particular account. I know where to look to see if a user is added, but if they continue to add themselves and get full control rights, they can also delete themselves after reading e-mails. Any direction would be helpful. In specific, I would like some logs as to what changes where made.

put a keylogger ..or screenshot capture software..wud work best than any log.