Find High-Bandwidth Email Accounts via Terminal

This guide shows you how to identify which email account is responsible for unusually high mail bandwidth usage on a cPanel server.

The Mail Bandwidth Report script analyzes current and rotated Dovecot mail logs, totals IMAP and POP3 traffic by mailbox, identifies the highest-bandwidth user, and shows which remote IP addresses and mail sessions generated the traffic.

Step-by-Step Instructions

Step 1: Log in to the Server as Root

Connect to the affected cPanel server through SSH and log in as root.

You can also log in to WHM as root and open:

WHM → Server Configuration → Terminal

ssh root@your-server-ip

Step 2: Run the Mail Bandwidth Report

Run the following command to download and execute the latest version of the reporting script:

curl -fsSL https://fixyourwordpress.com/mal_bw_report.sh | bash

The script must be run as root because it reads system mail logs and cPanel mailbox directories.

Step 3: Enter the Domain Name

When prompted, enter the domain you want to investigate.

Enter the domain to investigate: DOMAIN.EXT

Enter only the domain name. Do not include:

https://
www.
A mailbox name
A URL path

Step 4: Review the Executive Summary

The first section of the report provides a summary of the domain's mail bandwidth usage.

================================================================================
EXECUTIVE SUMMARY
================================================================================
Total mail downloads:          74.98 GB
Completed IMAP/POP sessions:   18496
Highest usage mailbox:         USER@DOMAIN.EXT
Top mailbox downloads:         69.68 GB
Top mailbox sessions:          6334
All other mailboxes:           5.30 GB
Top mailbox share:             92.9%

In this example, USER@DOMAIN.EXT is responsible for nearly all mail bandwidth used by the domain.

Step 5: Review Bandwidth by Mailbox

The report lists every mailbox found in the Dovecot logs and totals the data downloaded by its mail clients.

================================================================================
BANDWIDTH BY MAILBOX
================================================================================
  Downloaded    Sessions  Mailbox
  ----------    --------  -------
    69.68 GB        6334  USER@DOMAIN.EXT
     1.98 GB        1315  USER2@DOMAIN.EXT
     1.97 GB        1660  USER3@DOMAIN.EXT
   760.00 MB        3933  USER4@DOMAIN.EXT
   470.00 MB        1676  USER5@DOMAIN.EXT

This makes it easy to compare one mailbox against all other users on the domain.

Step 6: Confirm the Mail Protocol

The protocol section separates traffic generated through IMAP and POP3.

================================================================================
BANDWIDTH BY PROTOCOL AND MAILBOX
================================================================================
  Downloaded    Sessions  Proto   Mailbox
  ----------    --------  -----   -------
    69.68 GB        6334  imap    USER@DOMAIN.EXT

Large IMAP totals commonly indicate that Outlook, a mobile device, or another mail program repeatedly synchronized or rebuilt the mailbox.

Large POP3 totals may indicate that a client repeatedly downloaded all messages from the server.

Step 7: Identify the Source IP Addresses

The report attempts to match every completed Dovecot session with the remote IP address that opened the connection.

================================================================================
TOP MAILBOX SOURCE IP BREAKDOWN
================================================================================
Mailbox: USER@DOMAIN.EXT

  Downloaded    Sessions  Remote IP
  ----------    --------  ---------
    32.89 GB        1515  123.123.123.123
    16.74 GB        1282  12.31.12.31
    10.85 GB        1173  21.12.21.12
     8.29 GB           7  unknown
   200.00 MB         277  23.123.123.133

The IP breakdown can help determine whether the traffic originated from:

An office computer
A home internet connection
A mobile device
Microsoft Outlook infrastructure
A third-party archiving or synchronization service
An unknown or unauthorized device

What does “unknown” mean?
The disconnect and bandwidth record was available, but the matching login record was no longer present in the available rotated logs or could not be matched to its Dovecot session identifier.

Step 8: Review the Largest Individual Sessions

The largest-session section shows whether a mail application downloaded several gigabytes during a single connection.

================================================================================
LARGEST INDIVIDUAL SESSIONS
================================================================================
1. 8.50 GB  Jul 25 12:03:08 imap(USER@DOMAIN.EXT) ...
2. 8.28 GB  Jul 25 00:55:53 imap(USER@DOMAIN.EXT) ...
3. 7.51 GB  Jul 23 15:47:28 imap(USER@DOMAIN.EXT) ...
4. 7.20 GB  Jul 24 12:54:48 imap(USER@DOMAIN.EXT) ...
5. 6.82 GB  Jul 24 19:56:18 imap(USER@DOMAIN.EXT) ...

Several multi-gigabyte IMAP sessions strongly suggest a full mailbox synchronization, cache rebuild, or repeated download of large folders.

Step 9: Locate the Saved Report

The completed report is also saved under /root.

/root/mail_bandwidth_report_DOMAIN.EXT_20260727_193000.txt

You can open the report with:

less /root/mail_bandwidth_report_DOMAIN.EXT_20260727_193000.txt

Or download it through your preferred secure file transfer method.

Run the Report Without a Prompt

You may pass the domain directly to the script:

curl -fsSL https://fixyourwordpress.com/mal_bw_report.sh | bash -s -- DOMAIN.EXT

This is useful when running the report repeatedly or including it in an administrative workflow.

What This Script Checks

Current and rotated /var/log/maillog* files
Compressed and uncompressed mail logs
IMAP bandwidth by mailbox
POP3 bandwidth by mailbox
Completed mail session counts
Bandwidth by protocol
Remote IP addresses used by the highest-bandwidth mailbox
Largest individual Dovecot download sessions
Active Dovecot connections
cPanel account ownership
Mailbox disk usage and folder sizes

Understanding the Results

The report totals the number of bytes Dovecot sent from the server to IMAP and POP3 mail clients.

High download usage does not necessarily mean the user manually downloaded attachments. Mail programs routinely download message bodies, attachments, folder indexes, and mailbox metadata while synchronizing.

Common Causes of High Mail Bandwidth

Outlook rebuilding its OST file or local mailbox cache
A mailbox being deleted and recreated in cPanel
A mailbox being configured on several computers and mobile devices
A damaged Outlook or IMAP profile repeatedly resynchronizing
A user repeatedly removing and re-adding the account
Outlook mobile connecting through Microsoft infrastructure
A mail archiving or backup service downloading mailbox contents
An antivirus program repeatedly scanning or fetching messages
Large folders or attachments being downloaded multiple times
Unauthorized access using valid mailbox credentials

Recommended Corrective Actions

Identify every computer, phone, tablet, and external service configured with the affected mailbox.
Temporarily close Outlook and disable the mailbox on all secondary devices.
Determine which device contains the most complete and current copy of the user's mail.
Export or back up locally stored Outlook mail before deleting profiles or cached data.
Connect one primary device and allow it to complete one full synchronization.
Reconnect additional devices one at a time after the initial synchronization finishes.
Rebuild the Outlook profile if the same device continues downloading several gigabytes repeatedly.
Change the mailbox password if any source IP address is not recognized.
Avoid deleting and recreating the mailbox in cPanel unless the existing mail has been backed up and the consequences are understood.

Important Notes

Do not delete the mailbox as a first troubleshooting step. Deleting an email account from cPanel can remove the server-side mailbox data. Recreating the address creates a new mailbox identity, which can cause existing devices to perform a complete synchronization or attempt to reconcile their cached mail with an empty server mailbox.

The script must be run as root
The results only cover the mail logs currently retained by the server
Older activity may no longer be available after log rotation
The report measures completed sessions containing byte totals
Bandwidth totals may differ slightly from cPanel accounting
Localhost connections may appear as ::1
Microsoft mail services may appear under Microsoft-owned IP ranges
Changing IP addresses may represent the same mobile device

Example Customer Summary

We traced the unusually high bandwidth usage to USER@DOMAIN.EXT. The mailbox downloaded approximately 69.68 GB through IMAP across more than 6,300 sessions. Several individual sessions downloaded between 4 GB and 9 GB. This indicates that one or more mail applications repeatedly synchronized or rebuilt the mailbox. The affected devices should be disconnected, backed up, and reconnected one at a time so the source of the repeated synchronization can be isolated.