I have been battling against spamer using exchange and losing.. some notes
Nice write up on ExMon but sort of dated
http://www.msexchange.org/tutorials/Microsoft-Exchange-Server-User-Monitor.html
TraceLog.exe can be downloaded form here
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=1370
If you are trying to stop a trace use -- C:\Program Files\Resource Kit>tracelog -stop "Exchange Event Trace"
Note the above has to be typed it, if you paste it you will get the following error "Invalid option given: Event"
View ETL performace log using TraceRpt, it is in windows directory so can be run form the command line with the input file name.