Based on the Q&A going on for other answers, I believe you need to be using the Notes C API. In particular, you should be using the Extension Manager feature of the API. I'm basing this partly on your use of the word "intercept" in one of the answers. To truly do that, what you need to do is hook events in the Domino server's router mailbox files. But actually, there are two reasons for this:
That's what most compliance and security products tend to do in order to intercept messages before they are delivered.
There are always going to be fewer router mailbox files to hook than there are user mail files. So even if you don't have the technical requirement of catching the message before delivery, it's still a better idea to centralize rather than distribute the work across lots of agents in lots of user mailboxes, or to be hooking delivery yourself in lots of user mailboxes.
The usual technique for something like this involves a small-footprint DLL that hooks events and places messages into an "On Hold" state, and then signals another piece of code that is running as server task. That way the router won't try to process delivery of the message until you're code does everything it needs to do (which might take a few cycles if you have to wait for response when you are posting to your REST service). The server task is also written using the C API. (Java is also a potential option for server tasks. IBM has server tasks that are written in Java, but I've always gotten blank stares from IBMers when I've asked point-blank whether the interfaces for this are documented and supported for 3rd party use!) This server task code can inspect the message to see if it is being delivered to one of the users you need to be tracking, quickly release the hold if not, and then do whatever else it needs to do and then finally take it off hold.
Now, here's another thought. You already have a Windows service that uses Exchange Web Services, and it has all the logic in it that you really want. Why duplicate that logic? Domino supports deployment of your own web services, so perhaps the right way to do this is to use the extension manager to put the messages "on hold", but instead of a server task doing the processing you would create a Domino web service to pass the data back to your Windows services, closely mimicking the interfaces that you are already using to talk to Exchange. I'm not familiar with Exchange Web Services, and I don't know how you use it to have your Windows service be "listening", so I'm not certain whether this is really do-able with Domino's concept of web services. Maybe you might have to be "polling" rather than listening. Anyhow, it's just a thought.
