If your logs are showing the mail was delivered to the SERVER then I think the only step beyond that (if you choose to do so) is to look in the user's mailbox, etc.
This sounds like a bit of an "office politics" thing, am I correct?
If that's the case then I personally would probably just stop at this point and show the email was deleivered to the server and leave it at that. Trying to prove users are lying never ends up good.
People like to blame "computers" for everything. ;-)
I recently had a case where a user "stored" emails in their "Trash" folder (don't ask why) and then lost over 600 of their "stored" emails when the trash folder was deleted. They INSISTED someone logged into their email account and emptied the trash.
Aside from the obvious (DON'T save things in your TRASH folder) I was able to prove it was NOT conspiracy by grabbing screen shots and the proxy log for that computer. The user CLEARLY (accidentally) deleted their own Trash folder. (web based email client)
Their response... "Well I don't know if I was FOR SURE sitting at my PC between 4:45pm and 5:00pm... someone could have come along and deleted it!"
At this point its very important to just "state the facts". I'm not saying YOU did it... I'm saying that YOUR PC issued a deleteFolder command at exactly 4:47pm. So, whoever was sitting at your desk at 4:47pm did it.
End of story. ;-)