I had a strange problem crop up this morning.. one of my users emailed me saying that their email from a the last month had disappeared into their trash. This, unfortunately, is a hostile user.. so it would help smooth things over for everyone if I was able to find out when this occurred. Is there any logging trail that Dovecot has on that would allow me to see this? If not, would Thunderbird have that available?
This depends on how you setup your dovecot before the incident. Otherwise dovecot only logs the critical messages. As described in the manual: http://wiki2.dovecot.org/Logging
Thunderbird doesn't log user activity. You can only see logs (of the current session) under Tools->Activities.