The administrative log will show when something is done via webmail.
[2025.06.05] 10:10:21.212 [10.1.1.80] User admin@ as Aaron@domain.tld calling delete messages, folder: Inbox, owner: Aaron@domain.tld, all: , count: 0
[2025.06.05] 10:10:23.290 [10.1.1.80] User admin@ as Aaron@domain.tld calling patch message, owner: Aaron@domain.tld, count: 1, folder: Deleted Items
[2025.06.05] 10:10:26.244 [10.1.1.80] User admin@ as Aaron@domain.tld calling delete messages, folder: Deleted Items, owner: Aaron@domain.tld, all: , count: 0
Tony Scholz
System/Network Administrator
SmarterTools Inc.
www.smartertools.com