hello,
I am not a evernote specialist nor user so i am sure some other guy there could give you more advice but:
- you can check all email sent to a @m.evernote.com email address (on network or endpoint).
- you should also check all post done to a evernote.com URL (on endpoint as it will be done via https or network if you have ssl inspection/decryption capabilities).
Regards