Maybe they have accidentally setup POP3 on their mobile? Or maybe Outlook with auto delete under POP3 feature?

Hi Vince, 

As Tan mentioned, it's possible that the user has connected an email client via POP, and the email client has a setting to delete email at 90 days. 

Alternatively, it's possible that Folder Auto-Clean is enforced at the system, domain or user level. To check this: 

If neither POP or Folder Auto-Clean are the culprit, I'd encourage you to start a support ticket so we can look into this for you. (Any license with active Maintenance and Support is eligible for technical support, and you can start a ticket by logging into your SmarterTools account and navigating to My Tickets. 

Kind regards,

I checked the autoclean settings and they are not set.

The email that is being deleted after 90 days is being deleted from the deleted items folder. 

I also checked the autoclean log and do not see any entries there, I set the logging for detailed.

They claim to not be using any outlook or phone for email, just the webmail interface.

One thing I notice in the administrator log, is :

 IMAP Attempting to login user:  user123

then I also see this..

Webmail Attempting to login user: user123

Does this mean the user is using an external app connecting via IMAP, or does loging into webmail show this as IMAP as well?

VInce

Hi Vince, the administrative log entries you're seeing indicate the user is connecting via both webmail and an email client (IMAP connectivity) like Outlook or Thunderbird.

If you change your IMAP logs to detailed, it should show more information about the activity, including deletions via IMAP. Please submit a support ticket from My Tickets if you'd like our help in deciphering the logs. 

Kind regards,

That's great to hear, Vince! Thank you for the update.