KQL to find interactions with an email message. Note: some interactions will be Microsoft background processing, your CRM software or your backup software. https://blog.alexmags.com/posts/exchange-online-email-investigation/

MailItemsAccessed.kql

CloudAppEvents
| where Timestamp > ago(3d)
| where ActionType =~ "MailItemsAccessed"
| where Application has "Exchange"
| evaluate bag_unpack(RawEventData,'Event_') // JSON in RawEventData becomes columns prefixed by Event_
// filter on Event_ mailbox owner upn if only one mailbox is of interest
| where Event_Folders has 'Internet message ID here' // get message ID from eDiscovery
// https://blog.alexmags.com/tags/kql/