how to trace messages caught by malware filter

I edited the default malware filter to notify me when a message is caught. Today I have been bombarded with these messages.  I assume they are originating internally since we use a cloud based anti-virus filter which I assume would catch these messages before it is delivered to us.  Can I trace these messages to see if they are originating internally?

thanks