Hi everyone!

I have came across something very unusuall issue. When i came to office today one of the User complaint me that he hasn't received any email today, although there were emails in which he was cc and other receipents do received them.

I checked his email box and it was empty that time, I sent a test email from local account (Domain) and from a public email address and both were received. It was around 9:15 AM. All the emails after 9:15 were coming to his mail box and not a single email generated last night and early morning were there.

I asked one of the his department collegue to sent me emails in which that particular user is copied so that i can check the email id and can look at the time emails were sent. The email address was perfectly alright and most of them were replies so no chance of wrong email in it.

Since the user is using Microsoft Outlook and i have experienced in the past when the pst file of outlook reaches around 2 GB emails get lost and things like that and surprisingly the pst size was 900MB and also emails after 9:15AM were receiving no chance of pst get corrupted. Anyways i went to check the log of server, the email server i am using is MDaemon, and upon looking the routing details yes emails got received by server sametime when other users recived the emails.

Now i checked the POP log to see at what time the user fetched email from the Mdaemon today and i cam across the fact it was 9:03 first connection made to server by him and he downloaded 31 emails on his system (Mdaemon also log the IP from where the mail box is accessed).

So i went to the user ask him when he came to office he said around 8:50 and i asked him when he downloded his email he said around 9:02 or 03 may be and I said how many messages it showed at that time he I AM TELLING YOU THE MAIL BOX WAS EMPTY and soon after pausing for a while said there were 31 emails but dunno where they get downloaded.

Now what i am assuming here is the user is lieing here and he has Intentionally deleted all the emails as he is always looking to mess with the IT Department.

Although i have proof that emails got arrived on server and were downloaded into his PC and the user gave a false statement and then changed it after a while, i wanted to know is there any sort of log that is being maintained by Microsoft OUTLOOK to trace this issue?

If there isn't anything like that, how can i in future assure that such issues won't occur any suggestion?