Em /etc/dovecot/dovecot.conf:

service imap-postlogin {
    # all post-login scripts are executed via script-login binary
    executable = script-login -d /usr/local/bin/postlogin.sh
    # the script process runs as the user specified here (v2.0.14+):
    user = $default_internal_user
    # this UNIX socket listener must use the same name as given to imap executable
    unix_listener imap-postlogin {
    }
}

Em /usr/local/bin/postlogin.sh:

#!/bin/sh
# a) Filesystem based timestamp in user's home directory
touch ~/.last_login
 
# b) SQL based tracking. Beware of potential SQL injection holes if you allow
# users to have ' characters in usernames. Following is just an example:
#echo "UPDATE mailbox SET modified = now() WHERE username = '$USER'" | mysql postfixadmin
exec "$@"

Com esse esquema, ele cria um arquivo .last_login na home de cada usuário do Vmail

/var/vmail/sieve/dovecot.sieve :

require ["fileinto"];
 
# rule:[Move Spam to Junk Folder]
if header :contains "X-Spam-Level" "*****"
{
    discard;
    stop;
}
elseif header :contains "X-Spam-Level" "***"
{
    fileinto "Junk";
    stop;
}
elseif header :is "X-Spam-Flag" "YES"
{
    fileinto "Junk";
    stop;
}