[Dovecot] ot: trying to understand log entries, etc

[Voytek Eymont]

totally of, I'm trying to understand what's happening,
aka, 'how does email works' ?

I have Dovecot 1.x, all works fine

I noticed in the logs failed access from no-longer-hosted account/user,
physical account deleted/removed, most likely from user's BBerry, every
~15 minutes:

from /var/log/maillog
---
Jun 24 07:31:25 dovecot: imap-login: Disconnected: Inactivity (auth
failed, 1 attempts): user=<vvv at tld>, method=PLAIN, rip=101.222.222.222,
lip=111.111.111.111
---

I recreated account/physical path /var/mail/.../tld/vvv at tld
I logged in with webmail, all works, webmail logged out

I physically copied some emails (from another account) to physical path

../../tld/vvv at tld/new

after a while, I see the email files NO LONGER in ../../../new BUT now in
../../tld/vvv at tld/cur

Q: that means the email was accessed, doesn't it ?

BUT, I don't see any more access in the /var/log/maillog, not failed, not OK

I did see one, after I recreated account

Jun 30 20:01:53 dovecot: IMAP(vvv at tld): Disconnected: Logged out bytes=32/666

NONE since, but email files move from new to cur ??

if I observe email files moving from 'new' to 'cur' shouldn't I see some
action logged in /var/log/maillog to correspond ?

perplexed....

-- 
Voytek