The submodule field is in FortiMail log messages where type=kevent and either:
submodule
type=kevent
subtype=config
subtype=config-user