Original recipient
The original_to field is in FortiMail log messages where type=statistics and subtype=update.
The field indicates the original recipient email address, before recipient rewriting occurred. This can be used to correlate search results about the same session_id but modified recipient field (to) on FortiAnalyzer.
This field is empty if the recipient email address has not been rewritten.