Mar 05 09:32:10 imap-login: Info: Login: user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, mpid=82779, TLS, session=<iRsY3qxmVOwyURFj>
Mar 05 09:34:41 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, TLS: Disconnected, session=<yloH56xmNP4yURFj>
Mar 05 09:34:49 imap-login: Info: Disconnected (auth failed, 1 attempts in 6 secs): user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, TLS: Disconnected, session=<2LlA56xmUv4yURFj>
Mar 05 09:37:00 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, TLS: Disconnected, session=<qL5M76xmFv8yURFj>
Mar 05 09:37:06 imap-login: Info: Disconnected (auth failed, 1 attempts in 6 secs): user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, TLS: Disconnected, session=<7bpt76xmGf8yURFj>
Mar 05 09:38:33 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, TLS: Disconnected, session=<upLN9KxmmP8yURFj>
Mar 05 09:41:33 imap-login: Info: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, TLS, session=<1PX29KxmnP8yURFj>
Mar 06 07:18:46 imap-login: Info: Login: user=<problemuser@hisdomain.org>, method=PLAIN, rip=xx.xx.xx.99, lip=yy.yy.yy.25, mpid=21460, TLS, session=<IqHhHr9mZtAyURFj>
I am not sure where else to look.