Our users use both Thunderbird and web-client for mail clients.
We are using Version 5.0.16_GA_2921.RHEL5_64.FOSS Apr 29, 2009

I suspect that one of my users (or sysadmins) is reading someone elses mail. The user has complained about a "bug" that some read messages have changed back to unread.
His Inbox is not shared, so it would have to be either someone with his password is logging on or a sys admin is reading it using the web admin control panel and clicking View Mail.
Is there any way for me to figure this out? Is there something I can do so that if this happens in the future, I can check who or at what time his mail was accessed?