I’ve been working on a support query recently where a specific MDaemon user’s email was vanishing, and seemingly for no reason.
To help diagnose this issue I recommended they use the popular ‘Process Monitor’ tool to watch for any files being deleted in a specific folder and report which process is deleting them.