This article explains different ways to query those logs.
To enable that, select the option "Send spam logs to Apex Central" which is available under "Administration" > "Apex Central Settings".
Those logs will appear in Apex Central under the "Content violation category":
2. Send logs via syslog to a third-party log management system
This setting can be configured from "Logs" > "Log Forwarding". Under "Log Type" make sure the "Spam Prevention" is selected as shown below.
Note: The log forwarding setting is only available starting with ScanMail for Exchange 14
More information regarding the format of the syslog events sent by SMEX can be found in the following KB article: ScanMail for Exchange (SMEX) 14.0 Syslog content mapping guide