Symptoms
One email account for a domain cannot be logged into via an email client or Webmail, while other email accounts work. This includes the "Access Webmail" function in cPanel.
Description
Often this is caused by the account being blocked by cPHulk Brute Force Protection.
In "WHM » Security Center » cPHulk Brute Force Protection" under the "History Reports" tab, an entry for the connecting IP and address will be shown.
/usr/local/cpanel/logs/cphulkd.log will have a message similar to the following:
info [cPhulkd] Login Blocked: Too many failures for this username for this authentication database. [Service]=[dovecot] [Local IP Address]=[127.0.0.1] [Local Port]=[143] [Local User triggering request]=[user] [Remote IP Address]=[127.0.0.1] [Remote Port]=[37006] [Authentication Database]=[mail] [Username]=[user@domain.com] (18/3 failures) (blocked until [DATE])
Workaround
The block can be cleared in "WHM »Security Center » cPHulk Brute Force Protection" with the "Remove Blocks and Clear Reports" button from the "History Reports" tab.