totally of, I'm trying to understand what's happening, aka, 'how does email works' ?

I have Dovecot 1.x, all works fine

I noticed in the logs failed access from no-longer-hosted account/user, physical account deleted/removed, most likely from user's BBerry, every ~15 minutes:

from /var/log/maillog

Jun 24 07:31:25 dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts): user=vvv@tld, method=PLAIN, rip=101.222.222.222, lip=111.111.111.111

I recreated account/physical path /var/mail/.../tld/vvv@tld I logged in with webmail, all works, webmail logged out

I physically copied some emails (from another account) to physical path

../../tld/vvv@tld/new

after a while, I see the email files NO LONGER in ../../../new BUT now in ../../tld/vvv@tld/cur

Q: that means the email was accessed, doesn't it ?

BUT, I don't see any more access in the /var/log/maillog, not failed, not OK

I did see one, after I recreated account

Jun 30 20:01:53 dovecot: IMAP(vvv@tld): Disconnected: Logged out bytes=32/666

NONE since, but email files move from new to cur ??

if I observe email files moving from 'new' to 'cur' shouldn't I see some action logged in /var/log/maillog to correspond ?

perplexed....

-- Voytek