[exim] How to find authenticated user

Hi,
I am using exim (and dovecot) on cPanel server.
Is there a way to get a list of messages from a specific authenticated
user?

I mean:

2014-09-04 11:35:38 1XPTRt-0008R4-Sg <= fakeuser@???
H=(forged-helo) [123.123.123.123]:36686 P=esmtpa
A=dovecot_login:real.user@??? S
=1738862 id=8081AB2EAB64414D9E869DFDDB0987F4@forged-helo T="SPAM" for
recipient@???

In that case, I would like to identify all messages sent from
real.user@??? authentication (because the From: is ofter
forged..)
Thank you very much