App identification for mail routing

I have applications that are sending mail via NRPC through a route that is about to be shut down. I’ve been able to identify users who are sending mail via this route, but still find a large number coming from the server that I believe are sent from applications. Does anyone have a method on how to trace the applications that are sending this mail so that I can notify the database owners of the pending change?

Thanks.