You don't have to save the messages. You just need to look at the logs. If you had traffic to/from mail.google.com, no problem. But if you have traffic /to/ ashleymadison.com or whatever, that's suspicious