Hi Vince, the administrative log entries you're seeing indicate the user is connecting via both webmail and an email client (IMAP connectivity) like Outlook or Thunderbird.
Kyle Kerst
Lead Internal Network/System Administrator
SmarterTools Inc.
smartertools.com