In message log, when you filter by inbound>not delivered, I see many messages showing not delivered with reason "Pending Scan". However, if I take one of those examples and search the subject line, I will find that the message was indeed delivered eventually. This is misleading as it gives me the impression the messages were not delivered. It's as if ATP is putting in a log entry every time it attempts to scan the message and does not remove them once delivered.
In short, I have no way of finding messages that were indeed not delivered by ATP due to Pending Scan.