Hello Scott. This user's email getting purged would be something you'd find in the IMAP or EAS/MAPI logs depending on what protocol he is using on his Outlook installation.

Ultimately you should see manual deletes in our Administrative log if you're on our later releases, and any client-side deletes would take place in the appropriate protocol log.

If the delete happened via IMAP for instance you'd want to search that log for the EXPUNGE command relating to this user as that would indicate a delete. The EXPUNGE command will typically note a range of message IDs, so you'd want to look for something specifying a wide range of emails. 

If you need help tracking this down please don't hesitate to submit a ticket with us. Have a good one!

Whenever I see something like this I think, is there an email client inadvertently configured with POP rather than IMAP ?

The logs are useful but only if they are set with the appropriate verbosity but the resulting logs can be significant in size. We tend to only log exceptions by default.

It will not necessarily resolve the issue but if you backup during an overnight window between 21:35 and 07:30 are the 'grp' files present in the user's folder? Assuming you do backup knowing the time they ran plus if they were present or missing at this time reduces the window and may help locate a culprit.

Kyle thanks for the info.  I could not locate EXPUNGE in the logs during the time period.  Any other suggestions?

Scott, you are very welcome. You can check the Administrative logs to see if this user deleted or moved the messages manually via webmail. Beyond that I would recommend reviewing Nathan's suggestions as well as it's possible they may have POP'ed them down to an email client somewhere and could then theoretically upload them back via IMAP.

Scott, did you get this resolved ?