If you have been archiving the email this might have been simpler: Recover the email from the archive for the day in question, restore it to a different mailbox first; then check with the user, and delete all non-wanted email before restoring it to the Inbox.
You could even make a copy of the recovered email folder before transferring to the inbox. Then, if the problem recurs, you have a better starting point.
If you're not archiving the email, it's a good idea to start now. Disk space is so cheap, and you can add a drive to the server if needed, specifying the location of a folder on that drive for just the archive data. It's saved my butt on many an occasion. As you know, email gets "lost" for all kinds of reasons.
Indeed, I recently "fixed" a disk space problem by adding a RAID1 pair of 1TB drives to an SM server, copying the archive files there, changing the archive location to that folder on the new RAID volume and then stopping/restarting the SM service (the Windows service, not from within the SM GUI - doing it through the SM GUI does not work!).
Just before restarting the service, I used FastCopy to update the archive's new location with any changes from the old location - this took seconds; it had been set up in advance. After verifying that the new location was receiving the archived files, I deleted the archive from the old location. Voila, about 450GB of new space (in my case of course) on the SM main volume.
Hope this is helpful going forward.