That's pretty hard to answer with so little information since there are several ways to obtain that functionality. Is there for example any remote logserver in use, for example syslog-ng? Or look at the different cron locations if anything is put in place to parse the secure log. Do the mails get sent out instantly when someone uses sudo or periodically (with a delay)?. Just some ideas.