Are there logs to check if EMC was used to read users' mailbox?

Is there evidence that shows if an IT employee used EMC to access/read a users' mailbox (i.e. senior management)? We have suspicion an IT contractor accessed a users' mailbox without authorization. Will logs in event viewer show this?

Exchange 2010 is used.

Thanks!