zimbra.log has this info with a little command like foo...
Not perfect but it will get you enough to at least get a rough view of who is using IMAP. We are using the imap proxy(perdition) so that's why all the IP's are 127.0.0.1.
[zimbra@dogfood log]$ grep ImapServer zimbra.log | grep 'name='
2006-12-28 00:40:15,712 INFO [ImapServer-6786] [ip=127.0.0.1;email@example.com;] cache - Loading flagset cache
2006-12-28 02:51:35,956 INFO [ImapServer-7164] [ip=127.0.0.1;firstname.lastname@example.org;] imap - [ search is: in:"INBOX/Deleted Messages" (before:12/22/06) ]
2006-12-28 04:03:15,081 INFO [ImapServer-7369] [ip=127.0.0.1;email@example.com;] cache - Loading flagset cache