For PH entries, these are stored in a local cache after the first authentication for the day. Only if the user in question connects relatively few times and the reporting session happens to include that first connection of the day is this value ever significant for most users. It did not appear interesting as an avenue to pursue in the overall analysis. The average time it takes to open, read, parse and close the mailbox. The average size of the user's mailbox.
Large mailboxes indicate someone who is consistently leaving mail on the server.
This is a fiction. Each POP transaction includes presenting credentials for authentication, authentication of same, processing of mailbox and returning results of same. In fact, however, some users will start up their mail client once and leave it running as long as their desktop does not fail while others may start up a mail client only when they want to check mail. The script attempts to analyze the pattern of connections and distinguish between automatic connects from a single instance of starting a mail client and the irregular intervals that occur when no mail client is running. It probably does not do a good job, especially when very short transaction intervals typify the user.