We experienced the same thing but we tracked it down to Apple clients that do not use IMAP IDLE properly.

 

Many email clients offer the ability to use the IDLE function of IMAP. What the IMAP IDLE function does is leaves a connection open to the mail server so that when new email arrives it immediately alerts your mail client and pushes the new message to you.

 

This is a very good thing to have configured for your mailbox, in theory, however in practice the way that Apple Mail handles this function of the IMAP protocol it creates multiple IMAP connections, adding additional new connections at regular intervals and never closing them, instead of leaving just one connection open. Over time these can pile up, diminishing available resources on both your computer and the mail server. This can result in both Apple Mail and your device being sluggishly slow, or even being blocked from connecting to your mail server for a DoS (Denial of Service) attack.

 

You used to be able to disable IMAP IDLE client-side in Apple Mail (which resolved the issue entirely), however the ability to disable this function was recently removed in Mac OS 10.11 El Capitan. The only recourse at this point is to disable IMAP IDLE server-side in SmarterMail under SETTINGS > PROTOCOLS > IMAP by turning off the "Enable IDLE Command".

Just had this come up again, but for a slightly different reason. Mac Mail will open a new IMAP connection and re-authenticate for every folder that it needs to synch. If a user has X# of folders > Threshold # in Smartermail's IDS Denial of Service Rules then they will get blocked. (By comparison GMail limits to 15 IMAP connections) We experienced a user with 80+ folders triggering our Threshold of 60 every time Mac Mail attempted to synch folders. This is a 19 year old known issue with Mac Mail IMAP dating back to the last century...so it is unlikely that Apple will fix it anytime in the foreseeable future. Best options we can provide, as increasing the Threshold beyond 60 is ridiculous at this point, is to *STRONGLY* suggest that the user use local folders in Mac Mail for organizing their emails, or that they significantly decrease the number of folders that they keep in their mail account to prevent from violating the Threshold of IMAP connections.

I don't understand why they do it like that I'll look through the logs sometimes and notice that they connect, authenticate, then issue like 2-4 commands, stop and do it again on another connection for a different folder. Many times it will do this concurrently which can make reading and following whats happening in the logs when debugging Mac issues very difficult. Very unfortunate that it's been an issue that long and they haven't fixed it, typical Apple :/