Is there some log that I can see what forwarding a user setup (and when)?

Just about 100% sure that their password was cracked and someone logged in and added an email into the forwarding list to get a copy of all the users email.  But... I cannot find any reference in the logs to a forwarding change, nor am I seeing in any searchable fashion any of the emails going to the cracked account going to the address added into the forwarding list.

Any ideas ?