I've just been looking at the logs again this morning and I'm not 100% sure it's correct.
For example, I've had emails from a couple of users this morning who are on the logs, accessing via IMAP, however, both of them are showing as last access yesterday morning?
How often does it update and does it log all access protocols?
With regards to IMAP, how does it log IMAP connections, just the initial connection as it's held open on IDLE?
Just to add, I've just checked outbound mail logs and other users have been online and sending mail today, but access still shows as yesterday?