Answer
Some inbound emails which were blocked by GFI MailEssentials show the event id FAIL referencing the agent GfiAsRtSubmittedAgent as SourceContext in the Microsoft Exchange Message Tracking results.Here is an example:
"RECEIVE","SMTP","08D1918CA37CFF9C;2014-08-29T10:42:07.097Z;0","<49375106fcdff76fc1cf08979fa0c2d89860@domain1.com>","Email subject","sender@domain1.com","recipient@domain2.com","801","196.143.169.10","domain2.com","10.0.2.1","SERVER","SERVER\Receive Connector SERVER","","1866","1","",,"sender@domain2.com","00A: NTS: "
"FAIL","AGENT","GfiAsRtSubmittedAgent","","","","recipient@domain2.com","801","","SERVER","","","","","0","1","",,"sender@domain1.com",""
The behavior is normal. This FAIL event is logged because the email was actioned by GFI MailEssentials and removed from the Microsoft Exchange queue before it was delivered to the user's inbox.
As an example, if a spam email is being placed in the GFI MailEssentials quarantine or the delete action has been performed on the spam email.