I don't believe there is going to be a logfile to monitor. If there is a logfile to be found, your question should be asked on zimbra forums as the people on there may know if that logfile exists can exist in a logfile by modifying something with zmcontrol or something like that.
Personally, my approach to this problem would be to create a script to login to every mailbox, and look at every message in the drafts folder of every mailbox, output desired meta data information to Splunk HEC or local logfile to be consumed by splunk forwarder. Essentially you need a middle ware tier (or custom splunk app) to generate the information that you're looking to obtain from the mailbox to feed into Splunk.
