For your info, in /var/log/mail.log, I see lines like: Oct 24 16:09:50 imap-login: Info: Login: user=<xx@xxx.xxx>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, ...
for connections made from the webmail processes (which is local on the box, so that makes sense).
And lines like: Oct 24 16:10:05 imap-login: Info: Login: user=<xx@xxx.xxx>, method=PLAIN, rip=123.123.123.123, lip=234.234.234.234, ...
for connections from remote devices using IMAP.
Mail.log is the log of what the mailserver is doing. The webmail interface is completely separate - it logs in /var/log/roundcubemail.