An incident involves a phishing campaign that delivered a malicious macro-enabled document. After containment, the IR team must identify all affected users. Which data source most efficiently identifies who opened the document?

A is correct because email gateway logs identify all recipients (the delivery scope), and endpoint telemetry (process creation events showing Word/macro execution) confirms which users actually opened and ran the macro — providing a definitive affected host list. B is wrong because user surveys are unreliable; many users will not remember or may be reluctant to admit opening a suspicious file. C is wrong because searching sent items only shows the attacker's sent copies, not delivery to recipients. D is wrong because AV may not detect the malware (especially custom/obfuscated payloads), leaving undetected infections out of scope.