Hello,

I'd like to propose a feature for accountability on shared mailboxes accessed over IMAP/EAS.

The scenario. Many organizations have a single account (e.g. info@domain.com or orders@domain.com) that several employees access directly via IMAP from their mail clients. Today they all share one password, so when a message is deleted, moved, or marked as read, there is no way to know which person did it. Logs only show the mailbox account itself.

The request. Allow a mailbox to be accessed with multiple, individually identifiable credentials, and record that identity in the logs. Two possible implementations:

1. Master/alias credentials (Dovecot-style). Each user authenticates to the shared mailbox with their own personal credentials (e.g. login as info@domain.com*mario or via their own account with a granted permission), and every IMAP session/action in the logs is tagged with the real person's identity. Dovecot has offered this for years as "Master Users", and it's the main reason some sysadmins choose it over other servers.
2. Extended audit logging on shared resources. SmarterMail already supports sharing folders/mailboxes between users. Building on that, add a per-mailbox audit trail (delete, move, flag, expunge, send-as) that records the authenticated user who performed each action — similar to what Exchange offers with shared mailbox auditing.

Option 1 also has a security bonus: no more shared passwords to distribute and rotate when an employee leaves — you just revoke that person's access.

Why it matters. Shared credentials on group mailboxes are a compliance problem (GDPR accountability, ISO 27001) and a practical one: "who deleted that customer email?" is a question we currently cannot answer. This would be a strong differentiator for SmarterMail in business environments.

Thanks for considering it — happy to provide more details on the use case.