It's worth experimenting, but I'm not sure what logfile (if any) is going to record the IMAP client moving a message from one folder to another. It's not a postfix or amavisd operation, if my theory is correct, it's just an IMAP one. Try moving a message from one folder to another (say, inbox to drafts) and then tail your logfiles to see what, if anything is recorded. Wouldn't surprise me if the answer was "nothing."
I just checked. It looks like only new messages added get logged. I haven't looked at the code yet, but it might be possible edit the log4j.properties and turn on logging for IMAP copy.
You can check /opt/zimbra/log/audit.log to see if any of the accounts in question are getting logged in via imap. It's no guarantee to say they are moving the files, but it will be a step in some sort of direction.