Good afternoon Jorge,
You are correct. There are a few circumstances that email will be removed. We do observe similar situations where emails are pulled off of a server via POP or the use of a mobile device. You can certainly open the POP logs within SmarterMail and see if there is any details on the account in question.
Log into the Web interface as the System Administrator. Click on the wrench icon. Choose View logs. Select POP for the type and the surrounding dates or user account for the search field. You should see whether or not the account has POP enabled and if there are any DEL commands issued.
Another possible scenario is that the user or domain is configured to auto-clean a folder or their inbox. Please confirm if there is any policies or rules configured.
Thank You.