totally of, I'm trying to understand what's happening, aka, 'how does email works' ? I have Dovecot 1.x, all works fine I noticed in the logs failed access from no-longer-hosted account/user, physical account deleted/removed, most likely from user's BBerry, every ~15 minutes: from /var/log/maillog --- Jun 24 07:31:25 dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts): user=<vvv at tld>, method=PLAIN, rip=101.222.222.222, lip=111.111.111.111 --- I recreated account/physical path /var/mail/.../tld/vvv at tld I logged in with webmail, all works, webmail logged out I physically copied some emails (from another account) to physical path ../../tld/vvv at tld/new after a while, I see the email files NO LONGER in ../../../new BUT now in ../../tld/vvv at tld/cur Q: that means the email was accessed, doesn't it ? BUT, I don't see any more access in the /var/log/maillog, not failed, not OK I did see one, after I recreated account Jun 30 20:01:53 dovecot: IMAP(vvv at tld): Disconnected: Logged out bytes=32/666 NONE since, but email files move from new to cur ?? if I observe email files moving from 'new' to 'cur' shouldn't I see some action logged in /var/log/maillog to correspond ? perplexed.... -- Voytek