Hello,
From time to time spammers uses webmail to send spam (after obtain a password from a client of course) But if you check the logs you can see this in the /var/log/mail.info:
Apr 24 09:35:59 server dovecot: imap-login: Login: user=<
[email protected]>, method=PLAIN, rip=::1, lip=::1...