When searching for messages in the Message Audit Log (MAL) from the Control Center Status > Message Audit Logs page, the results contain more than the expected sender or recipient depending on the query. For instance, searching for all messages with recipeint test@testdomain.com will show You the messages from test@testdomain.com but also from usertest@testdomain.com as the keyword test@testdomain.com can be found on both.
This is expected based on the operation of Message Audit Logging and search engine.
Check out only the MAL records for the desired sender or recipient. For more details about message audit logs refer to the documentation.