In the new 2016 ESA is displayed for both the onsubmittedmessage and onroutedmessage events. This is not the case in 2010, where our agent is only listed on the onsubmittedmessage event. Why our agent is on both in this version?
Our exchange agent is based on the Exchange transport agent. Data Protection's design activity works with onSubmittedMessage to process email messages that pass through the transport pipeline. In 2016 it uses onRoutedMessage handler to dump eml files for diagnostic purpose.
The following cmdlet run at exchange shell shows the transport agents that are registered on various mailbox events - that include onSubmittedMessage and onRoutedMessage
> Get-TransportPipeline | fl