Introduction
If a cPanel account has large amounts of IMAP Bandwidth, it is often difficult to determine the exact email account or client causing the usage.
Procedure
Determine the usage of email addresses of cPanel account USERNAME:
uapi --user=USERNAME Email list_pops | grep -oP "(?<=email:\s).*@.*" | while read address ;do printf "$address: ";grep "$address" /var/log/maillog*|awk -F'/' '/bytes/{SUM += $NF}END {print SUM/1024/1024/1024"gb"}';done | sort -rhk 2
Determine IPs that recently logged into the account user@domain.tld and the number of connections:
grep "user@domain.tld" /var/log/maillog | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort | uniq -c | sort -nr
Note: The Microsoft Outlook client can use large amounts of bandwidth if the Mail to keep offline value is set too high.