Roger,
Below I have included id description. In a minor release, we will include the description with the id in the event logs. I am also changing this from a question to an idea to facilitate tracking this feature.
As you can find below: 20000 is for user creation, 20001 user deletion, and 20013 user password change.
//SYSTEM ADMIN
ServiceStarted = 10000,
ServiceStopped = 10001,
SpoolCount = 10002,
SystemUptime = 10003,
IDSRuleTriggered = 10004,
DomainAdded = 10005,
Memory = 10009,
Threads = 10010,
SpamAssassinFailure = 10011,
GatewayFailure = 10012,
ClamAVFailure = 10013,
GlobalSettingsChanged = 10014,
DomainRemoved = 10015,
VirusFound = 10016,
OutgoingMessageBlock = 10017,
NewVersionAvailable = 10018,
LicenseExpiration = 10019,
AddonExpiration = 10020,
QuarantinedOutgoingMessage = 10021,
UpgradeProtectionReminder = 10022,
DiskSpace = 10023,
BlacklistCheckChange = 10024,
BounceIoConsecutiveFailures = 10025,
//DOMAIN ADMIN
UserAdded = 20000,
UserRemoved = 20001,
MailingListAdded = 20002,
MailingListSent = 20003,
MailingListRemoved = 20004,
DomainSize = 20005,
AliasAdded = 20006,
AliasRemoved = 20007,
UserThrottled = 20008,
DomainThrottled = 20009,
MailingListBounceRemoval = 20010,
MailingListSubscribe = 20011,
MailingListUnsubscribe = 20012,
UserChangedPassword = 20013,
UserChangedForwardAddress = 20014,
//USER
LocalMessageDelivered = 30000,
RemoteMessageDelivered = 30001,
MailboxSize = 30002,
CalendarEventReminder = 30004,
TaskReminder = 30005,