Message trace is one of the most useful tools in email investigation. It's also one of the most over-trusted.
What it's great for:
- Did the message arrive, and when
- Who else received it
- What the filtering decided and what action was taken
- The path and timestamps, so you can line it up against everything else
What it can't tell you on its own:
- Whether anyone opened it
- Whether anyone clicked
- What happened in the mailbox after delivery
- Whether the sender's own account was compromised
"Trace says delivered" is the start of the question, not the answer. The rest lives in sign-in logs, mailbox audit data, and the headers.
One tool, one witness. You still need the others to corroborate.