My server logs on my NAV just drop off the bottom after a certain amount of time.
I just now "dropped" from the end of Dec. a user clicking on an email attachment that was malicious. Had to look at that in my logs for months.
I don't know what the default time period is, I've just left it alone. Probably a registry hack somewhere defines this.
If you're really feeling up to it, you can R click the log message and hit properties and show the user who's doing the clicking a friendly reminder that it's throwing you a message in the log file....and to please stop clicking on email attachments.