look for /var/log/maillog(*) and /var/log/mail.log(*)