Listing 3: Query to Return Total Message Size
SELECT TOP 10 Recipient-Address, COUNT(*) AS [#Messages], 
DIV(SUM(Total-Bytes),1048756) AS [MB Incoming]
FROM %logs%
WHERE [Event-ID] = 1028 AND Recipient-Address NOT LIKE '%-IS@%'
GROUP BY Recipient-Address
ORDER BY [#Messages] DESC