We had another case from client today.
I have provided the sequence of the event from our investigation.
1. Client login primary admin email account "primaryadminuser" at 07:22:32
2. Client change password and setting for user "userone" at 07:29:06
3. Log shows user "userone" was deleted by primary admin user at 07:31:43. The user "userone" is still on server but not the primary admin user "primaryadminuser".
4. On server maildata folder, and the accountlist.xml file last update stamp was 07:32, primary admin user "primaryadminuser" was not in there
5. On server maildata folder, the Users folder last update stamp was 07:32, primary admin user "primaryadminuser" folder was not in there
===administrative log between client===
[2018.11.18] 07:22:32 [client IP] [qyedhu] Login was successful for user: primaryadminuser@sampledomain.com ROLE: Domain Admin
[2018.11.18] 07:29:06 [client IP] [qyedhu] Password was changed for user'userone@sampledomain.com' by 'primaryadminuser@sampledomain.com'
[2018.11.18] 07:29:06 [client IP] [qyedhu] User 'userone@sampledomain.com' settings changed on domain 'sampledomain.com' by 'primaryadminuser@sampledomain.com'
[2018.11.18] 07:31:43 [client IP] [qyedhu] User 'userone@sampledomain.com' deleted on domain 'sampledomain.com' by 'primaryadminuser@sampledomain.com'
[2018.11.18] 07:34:25 [client IP] [qyedhu] 'primaryadminuser@sampledomain.com' logged out
[2018.11.18] 07:39:25 [client IP] [qyedhu] Attempting to login user: primaryadminuser@sampledomain.com
[2018.11.18] 07:39:41 [client IP] [qyedhu] Attempting to login user: userone@sampledomain.com
[2018.11.18] 07:42:33 [client IP] [qyedhu] Attempting to login user: primaryadminuser@sampledomain.com
[2018.11.18] 07:44:15 [client IP] [qyedhu] Attempting to login user: primaryadminuser@sampledomain.com
[2018.11.18] 07:44:20 [client IP] [qyedhu] Attempting to login user: userone@sampledomain.com
[2018.11.18] 07:45:13 [client IP] [qyedhu] Attempting to login user: primaryadminuser@sampledomain.com
[2018.11.18] 07:46:10 [client IP] [qyedhu] Attempting to login user: primaryadminuser@sampledomain.com
[2018.11.18] 07:46:32 [client IP] [qyedhu] Attempting to login user: primaryadminuser@sampledomain.com
[2018.11.18] 07:46:37 [client IP] [qyedhu] Attempting to login user: userone@sampledomain.com
[2018.11.18] 07:54:12 [client IP] [qyedhu] Attempting to login user:
primaryadminuser@sampledomain.com