SMTP Relay Logs

Hi All,
Has anyone else been able to ingest any logs from on-prem SMTP relays?
It occured to me recently that this is a potential blind sport for data exfiltration and wanted to see others’ take on how to achieve it.