Symante Messaging Gateways log files should contain an hash for every attachment.
Once a virus is identified by other means (e.g. client PC unusual network activity) you can calculate the hash and search for the hash in the log files (remotely collected).