Jay, while it wouldn't explicitly say that this was done manually, it would indicate timing, so we could look, for example, to see if there was a delta between when the message was "inserted into mailbox" and "marked as spam" - and we can also look for the creation of "Thread-index" headers to see if the message has been pulled into outlook - so yes, there would still be some inference that would have to happen, but a lot less
The problem with the email log search, is that it shows the delivery process, and then the "current state", but not timestamps, or what happened between delivery and "current"
Frank