Thanks for answering Cappalli.
Sorry if I sound ignorant, but where would I find the Guest Application log, would this be in the log files I've dumped from the server?
Customer is using their Exchange server, which is where I suspect the fault is. I just need a timestamp to prove it.
I've used the GUI and checked the Monitoring>Live Monitoring>Audit Viewer to search for the authentication, which I've found. Is the time stamp here what I'm looking for?
Thanks again.