yep it was your engineer and his name is Kirill Kuklin. Kirill is one of the best engineers I have ever worked with (had some few cases with him) so again big "thank you" to him for his fantastic work.
And please don't get me wrong, I didn't wannt to criticize anybody that the investigation has taken so much time (compared to the quite "simple" request), I just wannted to point out that if such a "simple" task takes so much time then there's obviously some space for improvement.
Well probably it's better to ask Kirill where he did find the information but I guess he found it in the proxy-logfile, there you should find sequences like:
03.01.2018 10:00:12 82 (9844) Subject: AW: here you finde the subject
03.01.2018 10:00:12 82 (9844) Last modified time: 03.01.2018 08:45:32 (UTC)
03.01.2018 10:00:12 82 (9844) Size: 73694
03.01.2018 10:00:12 82 (9844) Changed item:
03.01.2018 10:00:12 82 (9844) ID: [ID=AAMkADVkZjg4MzdkLThhZmUtNDM4NS05ZGFkLTVhNzAxM2QwNDKSELGAAAAAAAzL+ALOPiaRZ2l0IH6w8UfBwAyDmVlj0PcT58KH4nOpOWPAAAAAAEWAAAyDmVlj0PcT58KH4nOpOWPAAAhAav+AAA=]:[CK=CQAAABYAAAAyDmVlj0PcasHR5s4nOpOWPAAAhCnzH]
Probably you won't see that per default because we have enabled the extended logging and I can't tell you since when we enabled it (probably I was lucky that this mode has already been enabled).
Please let me know your thoughts - thank you!