audit.log, sync.log, and mailbox,log have the username and usually the client type, but not the connecting IP address. One could correlate audit.log with the rather voluminous Jetty access_log, but that's a lot of work, and it might be spoofable.

Entered as https://bugzilla.zimbra.com/show_bug.cgi?id=69039

Any suggestions?