If you have service levels to maintain in your environment and a finite amount of disk space, there is a pretty good chance that you have mailbox quotas set to prevent users from over running your storage space.
Periodically you may be asked to report on the messages that were rejected for your environment because of full mailboxes. When Exchange rejects a message because a user’s mailbox is full, it generates an NDR (Non-Deliverable Report) with a status code of 5.2.2. You can search the Message Tracking Logs for this status code to determine who failed to receive messages due to their mailbox being full.
The following oneliner will produce a simple CSV report at %temp%\TooFullNDR.csv that includes the sender, recipient, message timestamp and recipient status (for further diagnosis if needed) for the most recent 24 hour period.
This is a sample of what the above will output if you didn’t capture it as a CSV.
Timestamp : 11/07/2008 3:32:18 PM Sender : email@example.com Recipients : Michelle.firstname.lastname@example.org MessageSubject : Urgent: past due invoice RecipientStatus : 550 5.2.2 STOREDRV.Deliver: mailbox full. The following infor mation should help identify the cause: "MapiExceptionShutoffQ uotaExceeded:16.18969:AA000000, 17.27161:00000000D40000000000 00000F00000000000000, 255.23226:9D000000, 255.27962:FE000000, 255.17082:DD040000, 0.26937:94000000, 4.21921:DD040000, 255. 27962:FA000000, 255.1494:34000000, 255.26426:FE000000, 4.7588 :0F010480, 4.6564:0F010480, 0.22086:0F010480, 4.4740:05000780 , 4.6276:05000780, 4.23921:EC030000, 6.21970:0F01048040000C68 0F010480, 4.23921:EC030000, 6.21970:0F01048000806F670F010480, 4.24305:0F010480, 4.5721:DD040000, 4.6489:DD040000, 4.2199:D D040000, 4.17097:DD040000, 4.8620:DD040000, 255.1750:71040000 , 0.26849:0F010480, 255.21817:DD040000, 0.26297:0F010480, 4.1 6585:DD040000, 0.32441:0F010480, 4.1706:DD040000, 0.24761:000 00000, 4.20665:DD040000, 0.25785:00000000, 4.29881:DD040000".