link Track Webmail Logins On cPanel

If a user suspects unauthorised logins to their email on cPanel or you wish to perform an audit on a user, you can pull the IP, username and date/time from cPanel's access_log.