As per Microsoft: "These events are generated when messages in the user's mailbox fail to be converted. This can happen when antivirus programs strip off attachments from messages. The 12002 events are generated when a user with these messages in their mailbox, logs on to the server to access their mail".