This depends on a number of factors -- the server software being used (Courier, Dovecot, etc) but to answer most of your questions, and assuming this is a Linux-based mailserver:
Most of your informational log messages from the mail system will end up in
Note that a lot of this is also dependent on the
syslog daemon on the mail server itself, as to where the information ends up.
The POP3 protocol doesn't allow a client to identify itself outside of the protocol scope (i.e. there is no User-Agent string a la Apache access logs), IIRC.
The MAC address wouldn't mean anything in this scenario.
Any errors or other failures will be recorded as well, perhaps with more clarity depending on the logging options you have set.
Generally, you can retrieve the time the account was accessed (and with what login), and hte remote/local IP addresses used to do so. Here's an example line from a Dovecot login event:
Nov 30 18:20:46 SCSIServer dovecot: pop3-login: Login: user=<user2>,
method=PLAIN, rip=192.168.1.115, lip=192.168.1.199
Depending on the level of verbosity you need, you can adjust Dovecot's auth* parameters as well. I chose Dovecot because it is a common deployment, however, check your mailserver's documentation for more. If this is Exchange or another Windows service, start looking in whatever the appropriate event log is.