Exchange 2007 and higher no longer use SMTP Event Sinks.  Exchange 2007 and higher use transport agents for processing messages in the SMTP pipeline.  These agents are only present on the Edge Transport server and Hub Transport server.  The transport agents installed depend on the role assigned to the Exchange server.

By default, an Edge Transport server installs 10 transport agents, a Hub Transport server installs 2 transport agents and a Hub Transport Server with Exchange 2007 SP 1 installed installs 3 transport agents.  When the Microsoft Anti-Spam tools are installed, 6 additional transport agents are installed.

Third-party vendors, like Symantec, can write additional transport agents, which will also access and take action on email being transferred over the server.  By default, Symantec™ Mail Security for Microsoft® Exchange Server installs two agents. 

It is possible to see the full list of transport agents using the Exchange Management Shell (EMS). Open the EMS and type Get-TransportAgent | fl

Sample output from a Hub Transport server is listed below:

Identity : Transport Rule Agent
Enabled : True
Priority : 1
TransportAgentFactory : Microsoft.Exchange.MessagingPolicies.TransportRuleAgent.TransportRuleAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\TransportRoles\agents\Rule\Microsoft.Exchange.MessagingPolicies.TransportRuleAgent.dll

Identity : Journaling Agent
Enabled : True
Priority : 2
TransportAgentFactory : Microsoft.Exchange.MessagingPolicies.Journaling.JournalAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\TransportRoles\agents\Journaling\Microsoft.Exchange.MessagingPolicies.JournalAgent.dll

Identity : SMSMSERoutingAgent
Enabled : True
Priority : 3
TransportAgentFactory : Symantec.MailSecurity.Server.TransportAgent.SMSMSERoutingAgentFactory
AssemblyPath : C:\Program Files (x86)\Symantec\SMSMSE\6.0\Server\Symantec.MailSecurity.Server.TransportAgent.dll

Identity : SMSMSESMTPAgent
Enabled : True
Priority : 4
TransportAgentFactory : Symantec.MailSecurity.Server.TransportAgent.SMSMSESMTPAgentFactory
AssemblyPath : C:\Program Files (x86)\Symantec\SMSMSE\6.0\Server\Symantec.MailSecurity.Server.TransportAgent.dll

The SMSMSESMTPAgent, intercepts SMTP messages at OnEndOfData within the SMTP pipeline.

Open the EMS and type, Get-TransportPipeline, to view which transport agent is engaged at which stage of mail processing.

Event TransportAgents
----- ---------------
OnConnectEvent {}
OnHeloCommand {}
OnEhloCommand {}
OnAuthCommand {}
OnEndOfAuthentication {}
OnMailCommand {}
OnRcptCommand {}
OnDataCommand {}
OnEndOfHeaders {}
OnEndOfData {SMSMSESMTPAgent}
OnHelpCommand {}
OnNoopCommand {}
OnReject {}
OnRsetCommand {}
OnDisconnectEvent {}
OnSubmittedMessage {Journaling Agent, SMSMSERoutingAgent}
OnRoutedMessage {Transport Rule Agent, Journaling Agent}

NOTE: Exchange 2007 SP1 includes an extra event, OnResolvedMessage, between OnSubmittedMessage and OnRoutedMessage.

References
 

Microsoft Overview of Transport Agents
Microsoft Understanding Transport Agents (Part1)
Microsoft Understanding Transport Agents (Part 2)


Technical Information

Please note the following from the Symantec™ Mail Security Implementation Guide:

Mail Security automatically installs custom transport agents when you install the product on Hub Transport or Edge Transport servers. The Mail Security transport agents consist of an antispam transport agent and an antivirus transport agent. By default, the Mail Security transport agents are installed with a lower priority than the Exchange transport agents. If you modify your transport agent priorities, ensure that the Mail Security transport agents remain a lower priority than the Exchange transport agents.

IMPORTANT:
 

If Exchange 2007's built-in AntiSpam agents are installed (Install-AntispamAgents.ps1 ) after SMSMSE 6 is installed, our transport agents will, by default, retain a priority higher than the Microsoft AntiSpam agents.  They will have to be set lower using the EMS.  See Spam is not detected when Symantec Mail Security for Microsoft Exchange (SMSMSE) transport agents have a low priority for details.