For your info, in /var/log/mail.log, I see lines like:
Oct 24 16:09:50 imap-login: Info: Login: user=<firstname.lastname@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, ...
for connections made from the webmail processes (which is local on the box, so that makes sense).
And lines like:
Oct 24 16:10:05 imap-login: Info: Login: user=<email@example.com>, method=PLAIN, rip=220.127.116.11, lip=18.104.22.168, ...
for connections from remote devices using IMAP.
Mail.log is the log of what the mailserver is doing. The webmail interface is completely separate - it logs in /var/log/roundcubemail.