A ProofPoint inspector would allow us the ability to track changes related to user spam filters, distribution lists that had users added, etc.