From your logs, do you know where the emails came from that were then forwarded? In other words, the employee's computer or account has this email with the attachment. Can you tell Ms. Block where the document came from?
On December 9th, 2010. See this statement in context.