dovecot: imap-login: Aborted login (auth failed, 2 attempts in 2 secs) - usually working - perhaps timeout issue? Debug options?

Question

I have a mail server with a few dozen IMAP accounts. The configuration is correct for each account, every one of them tests OK.

When a client from a particular, very slow Internet connection attempts to connect, I get messages like these:

Mar 14 07:58:31 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 2 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<ETMgqX9mDraoAyqn>
Mar 14 07:58:31 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 2 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<EPggqX9mfqGoAyqn>
Mar 14 07:58:31 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 2 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<E3kgqX9mYJioAyqn>
Mar 14 07:58:37 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 4 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<YCZXqX9mHZSoAyqn>
Mar 14 07:58:37 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 4 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<5/JcqX9miKaoAyqn>
Mar 14 07:58:37 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 4 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<HTJYqX9m1p+oAyqn>
Mar 14 08:00:11 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 3 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<pesGr39mrICoAyqn>
Mar 14 08:00:11 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 3 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<bJ0Gr39mqYqoAyqn>
Mar 14 08:00:11 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 3 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<La0Gr39muZ2oAyqn>
Mar 14 08:02:08 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 2 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<lQsHtn9mH62oAyqn>
Mar 14 08:02:08 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 2 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<V8sHtn9mXruoAyqn>
Mar 14 08:02:08 mailserv dovecot: imap-login: Aborted login (auth failed, 2 attempts in 2 secs): user=<>, method=LOGIN, rip=111.111.111.111, lip=222.222.222.222, TLS, session=<WSIHtn9m5beoAyqn>

The client is at 111.111.111.111 here, the server at 222.222.222.222.

The client can at the same time successfully query three accounts on the server. They do not know of any other accounts queried from their client machine.

The possibilities for the problem are either a second, forgotten mail program on the computer trying a connect unbeknownst to the user (who is not a computer person), or a timeout issue due to a very slow (modem dialup) Internet connection of the client machine.

My questions therefore:

1. Can I find out which username and which client user agent (and perhaps even, which password) is used in these failed connection attempts? I have tried setting

   debug_log_path = /var/log/dovecot-debug.log
   auth_debug = yes
   

However, I could not find anything relevant in these (very noisy) logs, perhaps it is the wrong log file to record failed (or timed out) attempts? Why does the log say "user=<>"? Can I make that log line more helpful?

2. Can I ask dovecot whether these were wrong passwords or perhaps timeouts? I have set

   auth_policy_server_timeout_msecs = 17000
   

(default 3000) to no avail - but on the other hand the logs do say "2 attempts in 2 secs" so can I perhaps exclude a timeout anyway?