If Diagnostic Logging is set to Maximum under Authentication in the POP3 service on the server that hosts the user's mailbox, the following events are logged in the Application log of the server:
Event Type : Error
Event Source : POP3SVC
Event Category : Authentication
Event ID : 1022
Description : DS lookup for user User Logon Name, connecting from 172.16.30.31, failed with error 0x80040920.
Event Type : Error
Event Source : POP3SVC
Event Category : Authentication
Event ID : 1011
Description : Authentication attempt from <IP Address of Client Machine> to User Logon Name has failed with error 0x52e
Event Source : POP3SVC
Event Category : Authentication
Event ID : 1022
Description : DS lookup for user User Logon Name, connecting from 172.16.30.31, failed with error 0x80040920.
Event Type : Error
Event Source : POP3SVC
Event Category : Authentication
Event ID : 1011
Description : Authentication attempt from <IP Address of Client Machine> to User Logon Name has failed with error 0x52e