I was auditing a set of mail servers at work the other day getting a list of all active user accounts and developed this little one liner:
zgrep LOGIN /var/log/mail.log.[1-9].gz | sed -n 's/.*user=\(.*\), ip.*/\L\1/p' | sort | uniq >> /tmp/mailbox.list
This script finds all logins from the mail log and prints out only the account@domain portion in lowercase sorting and printing one of each occurrence.