Audit events on a mailbox

There is not a consistent way to capture this activity through audit log search due to audit log search only captures the mail forwarding configuration changes when it changed by the admin.

For a consistent view, you need to check the mailbox properties to find whether forwarding is set. Run the below script to get all the mailboxes with forwarding enabled.

Get-mailbox | select DisplayName,ForwardingAddress | where {$_.ForwardingAddress -ne $Null}