Hello, I do not believe these changes are logged to the Administrative logs. However, you should see a logon event listed some time before the change that would indicate who made the change and when, even if it doesn't show you the change being made. I suggest acquiring the end user's IP address (home and office location) then check the Administrative log for any logons not matching those addresses. At that point you should have confirmation someone else configured this setting, or that an administrator must have configured the forwarding address.

Hi kyle,

Thanks for your reply.

Problem is, customer didn't know when it was being changed. 

Is there another way to find this out?

I presumed with Smartermail, it would log any actions such as this for future due diligence.

I think a comprehensive logs would be good.

Is it something that can be put on a "wish list" kind of thing?

As an aside, to alleviate this concern in the future, you can create a system-level event that will send an email when a user has modified their forwarding address. The Event Category would be User, and the Event Type would be User Changed Forward.