As far as what's going on right now with your sites mdl_log_store_standard log you could do command line queries with whatever restrictions/inclusions/exclusions you want. I have one for collecting actions by admin level users only on that system mentioned. Have another as a matter of 'defense' when/if the automated webservices hickups - which it did at one time ... due to how entity programmed the far end. They never confessed but I gathered they were using webservices to update mdl_user table every day ... no gaps in id numbers of mdl_user. A student account had in-advertently been changed to id 2 (the original admin user) thus giving that student admin rights to the system. Had I not inquired ... no one on the other end getting any notifications emails ... that student could have done a lot of damage just playing around with new toy! Not to mention getting the highest scores, etc.
The sending of messages via EMail you will see is logged as being an action by your default admin user ... moodle task/cron job.
On this system, go to your preferences and see what's there for Messages (private messages). On your server do same for a student account.
https://docs.moodle.org/37/en/Messaging_FAQ
an old moodle doc:
https://docs.moodle.org/23/en/Messaging_FAQ
and a really old one:
https://docs.moodle.org/19/en/Messaging
https://docs.moodle.org/19/en/Messaging_enhancements
https://docs.moodle.org/dev/Messaging_2.0
In your code ... message - there is an upgrade.txt file.
'SoS', Ken