Is it possible to filter (grep) exim_mainlog for emails that had attachments? I'm looking through a really long log for an email of which I don't have any information about other than the sender and that it had an attachment. Sender alone returned hundreds (POOMA) of entries. So I'd like to narrow it down.
The "S=" part of the log entry is the size of the message. Assuming the sender attached something more substantial than what was usually sent, you could try looking for a large email that way.