Internal mail system will inevitably receive in the course of some spam, these junk mail also take up some user mailboxes resources, this document describes the use of exchange management shell tool bulk delete the spam internal exchange server.
Examples:
Example 1:
This example searches the mailbox of Joe Healy and copies the search results to JoeHealy-ProjectHamilton folder DiscoveryMailbox the
Search-Mailbox -Identity "Joe Healy" -SearchQuery "Subject: Project Hamilton" -TargetMailbox "DiscoveryMailbox" -TargetFolder "JoeHealy-ProjectHamilton" -LogLevel Full
Example 2:
This example searches April Stewart's mailbox subject contains the message "Your bank statement" phrase, and the results recorded in the administrator's mailbox SearchAndDeleteLog folder. Mail will not be copied to the destination mailbox.
Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject: "Your bank statement"' -TargetMailbox "administrator" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full
Example 3:
This example searches April Stewart's mailbox subject contains the message "Your bank statement" phrase, and then delete these messages from the source mailbox. You must assign the "Mailbox Import Export" management role to use DeleteContent switch.
Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -DeleteContent
These are some examples on search-mailbox using Microsoft official for exchange2013 given us to make some changes based on examples to meet the needs of our business on spam finishing.
Demand For example:
1, delete the sender from within the enterprise in a mailbox for the mail, "Please turn the relevant sector", here to testzhang user as an example.
Open exchange management shell, use the following command
Search-Mailbox -Identity "testzhang" -SearchQuery 'from: " Please turn the relevant departments"' -TargetMailbox "administrator" -TargetFolder " SearchAndDeleteLog" -LogOnly -LogLevel Full
meaning of the command: Search testzhang a user's mailbox contains messages from all senders "Please turn the relevant departments" keyword, and the search results will be sent to SearchAndDeleteLog file administrator mailbox folders. (If you want to search for a specific keyword theme parameters will be changed from subject)
can be seen, the search to three similar messages, we can open the mail administrator to view the specific search results. 
Note that the above command during or immediately after the beginning of the following red box is a failed state, we need to wait a few minutes, depending on the amount of time based on the search, then refresh the mailbox interface when status changes succeeded indicate that the search is complete. Particular search result in search resu ~ .zip files attached to this, we downloaded for viewing. 
Unzip attachments, open the file in text mode 
if you want to excel open the csv file, you need to change mode, otherwise they will be garbled, click File, Save As, change the encoding to ANSI, save and replace the original file
opened with excel again, you can see, for the sender: Please turn user-related departments sent three messages to testzhang 
confirm completion of the above is to delete these spam after spam by the following command.
Search-Mailbox -Identity "testzhang" -SearchQuery 'from:
可以通过以上搜索命令再次搜索该邮箱，确认已全部清除“请转相关部门邮件”
2、 从企业内部所有邮箱中删除发件人为“请转相关部门”的邮件。
在exchange management shell运行如下命令
Get-Mailbox | Search-Mailbox -SearchQuery 'from:"请转相关部门"' -TargetMailbox "administrator" -TargetFolder "SearchAndDeletelog" -LogOnly -LogLevel full
该命令的意思：搜索企业内所有邮箱，发件人为“请转相关部门”的邮件，并将搜索结果发送到administrator邮箱
这条命令因为搜索的是所有用户的邮箱，所以时间可能需要5-10分钟，具体根据用户量而定。
搜索过程……会一个个邮箱搜索过去
显示0B的意思是该邮箱没有符合条件的垃圾邮件，等待搜索完成，到administrator邮箱查看具体搜索结果。因搜索量比较大从failed状态变为succeeded状态可能需要点时间。
可以看到如下搜索结果
目前搜索到4千多条记录，若记录超过10000条，需根据命令提示使用new-mailboxsearch命令
注意：需要在确认以上邮件全部为垃圾邮件之后，才可以用以下命令对这些垃圾邮件进行清除，以免误删正常邮件。
Get-Mailbox | Search-Mailbox -SearchQuery 'from:"请转相关部门"' –DeleteContent
清除根据邮件数量也需要一定时间。