We have had issues with compromised Exchange accounts sending a large amount of unsolicited e-mails out. We have mitigated this by using a cloud e-mail gateway that does a better job in detecting these outgoing messages as to not hurt our e-mail reputation. However, we would still like to detect any abnormal e-mail activities. One idea is a report of the Exchange accounts with the most outgoing message. Any idea on how to do this? Or a similar stat that may be indicative of an account being compromised?