This program doesn't take into account for how the GWIA processes multiple messages concurrently. An incoming message and an outgoing message could be logged before all the recipients are listed for the incoming message.
This program simply takes the recipients and apply them to the last sender from a GWIA log. There is a MSG number that keeps the records tied together. This program ignores it.
For example (bolded records belong together):
GWIA LOG - Stripped down
08:00:00 040 MSG 100001 Sender: Smith@YourDomain.com
08:00:00 040 MSG 100001 Recipient: Someone@OtherDomain.com
08:00:00 03C MSG 100002 Processing inbound message:
08:00:00 03C MSG 100002 Sender: firstname.lastname@example.org
08:00:00 03C MSG 100002 Recipient: Jones@YourDomain.com
08:00:00 040 MSG 100001 Recipient: Sometwo@OtherDomain.com
08:00:00 03C MSG 100002 Queuing to MTA
This program will incorrectly show that email@example.com sent a message to Sometwo@OtherDomain.com, both of which are outside YourDomain.com