The module field is in FortiMail log messages where type=kevent and either:
module
type=kevent
subtype=config
subtype=config-user