During an incident in Microsoft Defender XDR, you are investigating a suspected business email compromise. A user's mailbox is confirmed compromised, and you need to determine whether the attacker accessed or exported specific messages, and which client or IP was used to read individual items in the mailbox. Which investigative action provides the most precise per-item evidence of what the attacker viewed?