different auth-worker log


Verified User
Nov 9, 2004
On the same server, the same user, but in /var/log/maillog, I have 2 different types of log:
One is

Feb 21 03:56:22 server-name dovecot[27687]: auth-worker(2010): passwd(user-email-address): unknown user
Another one is

Feb 21 04:31:34 server-name dovecot[27687]: auth-worker(2795): passwd(user-email-address,,<YWHvZrFlaot/AAAB>): unknown user
Another one is
Feb 21 02:01:14 server-name dovecot[27687]: auth-worker(27227): passwd(user-email-address,xx.xxx.xxx.xx,<DCBQTa9lZY5xFzJm>): unknown user
So, the questions are:
1. If I understand correctly, is showing that that user accesses email from webmail? While in the third example, xx.xxx.xxx.xx is their real IP.
2. What is the third arg of command passwd?
3. Why is there only user-email-address in the log in the first case?

Thanks a lot.