Hi,

In our company we use an account for sales with multiple user login by webclient.
Some of them, move to trash some email, and we want to know who did it.

Some logs are:


192.168.27.119 [1440] 09:54:24 >>> operadores operadoresredes@nuevosigl webmail:iq:accounts set 0.216101 Action:refresh
<?xml version="1.0" encoding="utf-8" ?><iq sid="wm-5a573da7648e8021629037" uid="operadoresredes@nuevosiglo.com.uy" teamchat_token="xoxp-b4102507c878007c24e56409fa056311593f859ba843acf367 bbda2fe11df8a5" type="result"><query xmlns="webmail:iq:accounts"><account uid="operadoresredes@nuevosiglo.com.uy" mbox_quota="2048000" mbox_usage="1852833"><folder uid="INBOX"><type>M</type><sync>1</sync><inherited_acl>0</inherited_acl><rights>riwtlka</rights></folder><folder uid="INBOX/LUCIA"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/mkt"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/GISELLE"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/mkt/Programación"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/mkt/SORTEOS-PROMOS"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/mkt/RESPUESTAS"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid=
"INBOX/Graciana"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/SEBASTIAN"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="Borradores"><default>D</default><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="Enviados"><default>S</default><type>M</type><sync>1</sync><inherited_acl>0</inherited_acl></folder><folder uid="Papelera"><default>H</default><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="Files"><default>F</default><relative_path>Files</relative_path><type>F</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Caro"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="Spam"><spam>true</spam><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/OPERATIVA"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Lucia C"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Lucía Martinez"><type>M</type><
inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Belen"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Facundo"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/TEAMS"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/TEAMS/MARTIN"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/TEAMS/NADIA"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/TEAMS/Nacho"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/TEAMS/ROSA"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/NSTV"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/JAVIER"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Milagros"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Michelle"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Claudi
a"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Mádelme"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Romina"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Maximiliano"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/PROTOCOLOS"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Marcelo"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/NSBOT"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Laura"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Caro Corralejo"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/MARIANA"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="INBOX/Martin Neme"><type>M</type><inherited_acl>0</inherited_acl></folder><folder uid="Calendar"><default>E</default><relative_path>Calendar</relative_path><typ
e>E</type><inherited_acl>0</inherited_acl><rights>riwtlkxabcde</rights></folder><folder uid="Tasks"><default>T</default><relative_path>Tasks</relative_path><type>T</type><inherited_acl>0</inherited_acl></folder><folder uid="Journal"><default>J</default><relative_path>Journal</relative_path><type>J</type><inherited_acl>0</inherited_acl></folder><folder uid="Notes"><default>N</default><relative_path>Notes</relative_path><type>N</type><inherited_acl>0</inherited_acl></folder><folder uid="Contacts"><default>C</default><relative_path>Contacts</relative_path><type>C</type><inherited_acl>0</inherited_acl></folder><folder uid="Quarantine"><type>Q</type><inherited_acl>0</inherited_acl><rights>riwtl</rights></folder><folder uid="SPAM_QUEUE/Whitelist"><type>QL</type><inherited_acl>0</inherited_acl><rights>riwtl</rights></folder><folder uid="SPAM_QUEUE/Blacklist"><type>QL</type><inherited_acl>0</inherited_acl><rights>riwtl</rights></folder><folder uid="__@@VIRTUAL@@__/__@@EVENTS@@__"><
type>E</type><inherited_acl>0</inherited_acl><rights>riwtlkxabcde</rights><virtual><folders><folder primary="true">Calendar</folder></folders></virtual></folder><folder uid="__@@VIRTUAL@@__/INBOX"><type>M</type><inherited_acl>0</inherited_acl><rights>rwtlkx</rights><virtual><sharetype>all</sharetype><search>hola mi consulta cual es el costo mensual ? se el futbol uruguayo</search></virtual></folder><folder uid="__@@GWTRASH@@__"><type>G</type><inherited_acl>0</inherited_acl><rights>rtl</rights></folder></account></query></iq>
192.168.27.119 [1440] 09:54:24 <<< Unauthorized Request start (wm-5a573da7648e8021629037)
192.168.27.119 [1440] 09:54:24 <<< 4140844336 operadoresredes@nuevosigl webmail:iq:items get
<iq sid="wm-5a573da7648e8021629037" uid="4140844336654924001515675264509" type="get" format="json"><query xmlns="webmail:iq:items"><account uid="operadoresredes@nuevosiglo.com.uy"><folder uid="INBOX"><item><values><subject> </subject><to> </to><sms> </sms><from> </from><date> </date><size> </size><flags> </flags><has_attachment> </has_attachment><color> </color><priority> </priority><smime_status> </smime_status><item_moved> </item_moved><tags> </tags><ctz>-180</ctz></values><filter><limit>27</limit><offset>0</offset><sort><date>desc</date><item_id>desc</item_id></sort></filter></item></folder></account></query></iq>
192.168.27.119 [1440] 09:54:24 >>> 4140844336 operadoresredes@nuevosigl webmail:iq:items get 0.039897
<?xml version="1.0" encoding="utf-8" ?><iq sid="wm-5a573da7648e8021629037" uid="4140844336654924001515675264509" teamchat_token="xoxp-b4102507c878007c24e56409fa056311593f859ba843acf367 bbda2fe11df8a5" type="result"><query xmlns="webmail:iq:items"><account uid="operadoresredes@nuevosiglo.com.uy"><folder uid="INBOX" count="5" recent="0" offset="0" rights="riwtlka"><item uid="228793"><values><from>Twitter &lt;verify@twitter.com&gt;</from><flags>32</flags><to>&quot;Nuevo Siglo&quot; &lt;operadoresredes@nuevosiglo.com.uy&gt;</to><priority>3</priority><item_moved>1515674858</item_moved><subject>Nuevo inicio de sesión de Twitter desde Chrome on Windows</subject><date>1515674700</date><size>23550</size><smime_status>1</smime_status><color>Z</color><has_attachment>false</has_attachment></values></item><item uid="228544"><values><from>&quot;Eleonora Fain&quot; &lt;efain@nuevosiglo.com.uy&gt;</from><flags>33</flags><to>&quot;Operadores de redes&quot; &lt;operadoresredes@nuevosiglo.co
m.uy&gt;, operaciones@nuevosiglo.com.uy</to><priority>3</priority><item_moved>1515616425</item_moved><subject>Re: NSNOW suscripcion</subject><date>1515616362</date><size>45654</size><smime_status>1</smime_status><color>Z</color><has_attachment>false</has_attachment></values></item><item uid="228481"><values><from>&quot;Ignacio Rodriguez&quot; &lt;irodriguez@nuevosiglo.com.uy&gt;</from><flags>32</flags><to>&quot;Operadores de redes&quot; &lt;operadoresredes@nuevosiglo.com.uy&gt;</to><priority>3</priority><item_moved>1515602417</item_moved><subject>Re: Fw: Consulta Técnica</subject><date>1515602416</date><size>37600</size><smime_status>1</smime_status><color>Z</color><has_attachment>false</has_attachment></values></item><item uid="228456"><values><from>&quot;Operadores de redes&quot; &lt;operadoresredes@nuevosiglo.com.uy&gt;</from><flags>32</flags><to>pnoya@nuevosiglo.com.uy, salonso@nuevosiglo.com.uy, racardoso@nuevosiglo.com.uy, dmarangelo@nuevosiglo.com.uy, operadoresrede
s@nuevosiglo.com.uy, operaciones@nuevosiglo.com.uy</to><priority>3</priority><item_moved>1515599405</item_moved><subject>Fw: Consulta Técnica</subject><date>1515599350</date><tags>Esperando respuesta</tags><size>3418</size><smime_status>1</smime_status><color>Z</color><has_attachment>false</has_attachment></values></item><item uid="228302"><values><from>&quot;Natalia Cirelli&quot; &lt;ncirelli@nuevosiglo.com.uy&gt;</from><flags>33</flags><to>&quot;Operadores de redes&quot; &lt;operadoresredes@nuevosiglo.com.uy&gt;</to><priority>3</priority><item_moved>1515527401</item_moved><subject>RE: Re[2]: Benchmark</subject><date>1515527342</date><tags>Esperando respuesta</tags><size>111747</size><smime_status>1</smime_status><color>Z</color><has_attachment>false</has_attachment></values></item></folder></account></query></iq>



How can I see when a email is delete, move to a folder or sent to trash?

Best regards.