[Dovecot] Couple of questions about the logs

[Steve Campbell]

The log entries for imap disconnection shows a "bytes = x/y" format 
where the x equals bytes sent from client and y equals bytes received 
from client.

Can someone explain that a little better to me, please? In an imap 
account, does this "y" represent the size of the header information 
being returned to the client or the amount of data of the email mailbox?

Also, is there a way to tell if an email has been deleted (or marked for 
deletion) when using an imap client?

Here's the situation:

I've got a user who uses imap when using his phone and webmail. When in 
the office, he uses a pop3 client on his desktop. He indicates he's 
missing some emails from the weekend when first turning on his desktop. 
I know of no way to discover if he's deleted and then purged email from 
his mailbox using imap clients. I've checked the logs and he does not 
access his mailbox simultaneously from any of the 3 clients.

I can find 31 emails he received since his last pop login on Friday 
until his first pop login on Monday. The pop login indicates he received 
only 27 emails during the pop retrieval.

I'm a little lost here. Any help would be appreciated in interpreting 
the logs or suggesting how this might have happened.

thanks

steve campbell