My theory is these are likely leftover sessions that haven't timed out. You can check who is actually logging in to those accounts by checking the IPs listed in the Administrative logging for those user accounts though, and if you see any that don't match your customer's public IP address you can then blacklist as needed. On your own login, is it possible it is showing something like ::1 or 127.0.0.1 for your session? These would imply loopback and indicate you're logging on directly to the server. I hope this helps :)

These are the admin ones currently. Is this because the webmail is sitting on a server which the dns is held on cloud flare?

There is only myself as admin and none of these are my IP address.

That is likely yes. If you're routing all traffic through Cloudflare (with the cloud icon enabled) all traffic will come in via Cloudflare IPs. 

OK, thanks that may well explain it.