It might depend on how your logging is setup, but I think this would work on a default system:
grep -oP "A=\K([A-Za-z0-9_.:]+)" /var/log/exim4/mainlog | sort | uniq -c | sort -nr
Which would output something like this:
What I do here is to find A= which contains the username and how they were authenticated from /var/log/exim4/mainlog, then I pipe it to
uniq -c, which aggregates them as a group and gives you a number. The last
sort -nr just gives me the count in an ordered group in reverse (max number first).
If you have different types of authentication, let's say dovecot_plain and dovecot_login but with the same username, then the easiest way to get rid of that is to put in another grep that only get what is after ":", like so:
grep -oP "A=\K([A-Za-z0-9_.:]+)" /var/log/exim4/mainlog | grep -oP ":\K(.*)" | sort | uniq -c | sort -nr
And the output:
Note: I have not take in account the 24h limit, since that also depends on how logging is setup, and it gets more complicated and I think this is a good start. Otherwise you need to somehow filter your log timestamps with grep to ilter the dates, then pipe that to my grep string.