Hello Tony,
Thanks.
Our settings for POP logs are detailed.
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] connected at 7/12/2022 8:40:12 AM
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] CAPA
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] USER jan@xxxxxxxxxxxxxxx.com
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] PASS XXXX
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] jan@xxxxxxxxxxxxxxx.com logged in
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] STAT
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] +OK 45 11412789
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] UIDL
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] uidl list given for 45 messages
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] LIST
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] list response given with 45 messages.
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] RETR 23
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] retr completed for message 23
[2022.07.12] 08:40:12 [xx.xxx.xx.xx][57042148] disconnected at 7/12/2022 8:40:12 AM
I guess number 23 is one of the emails that is the culprit.
After removing email with "Potentially dangerous scripts"
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] connected at 7/12/2022 8:45:03 AM
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] CAPA
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] USER jan@xxxxxxxxxxxxxxx.com
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] PASS XXXX
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] jan@xxxxxxxxxxxxxxx.com logged in
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] STAT
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] +OK 41 11076870
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] UIDL
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] uidl list given for 41 messages
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] LIST
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] list response given with 41 messages.
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] RETR 22
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] retr completed for message 22
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] RETR 23
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] retr completed for message 23
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] RETR 24
[2022.07.12] 08:45:03 [xx.xxx.xx.xx][57622907] retr completed for message 24
Etc. for message 25-38
[2022.07.12] 08:45:08 [xx.xxx.xx.xx][57622907] RETR 39
[2022.07.12] 08:45:08 [xx.xxx.xx.xx][57622907] retr completed for message 39
[2022.07.12] 08:45:08 [xx.xxx.xx.xx][57622907] RETR 40
[2022.07.12] 08:45:08 [xx.xxx.xx.xx][57622907] retr completed for message 40
[2022.07.12] 08:45:08 [xx.xxx.xx.xx][57622907] RETR 41
[2022.07.12] 08:45:11 [xx.xxx.xx.xx][57622907] retr completed for message 41
[2022.07.12] 08:45:15 [xx.xxx.xx.xx][57622907] QUIT
[2022.07.12] 08:45:15 [xx.xxx.xx.xx][57622907] disconnected at 7/12/2022 8:45:15 AM