1) First, determine where the email in question is from. I actually coded a feature last night which will help you do this. Grab these pre-release binaries to get the feature. https://www.directadmin.com/clients
click your license, and follow the pre-release link.
2) Note that the bulk of email is already going to be counted within the System Quotas for the User. That data will be in /home/user/Maildir or /home/user/imap. You can check those folders for the 5 gig. If it's there, then either the permissions are wrong on the data, or the system quotas are not working correctly.
Permissions: http://help.directadmin.com/item.php?id=173
System quotas: http://help.directadmin.com/item.php?id=42
(FYI: ensure that /usr/sbin/exim is chmod to 4755 after due to due a recently found bug
3) However, if the system quotas are correct, and the 5 gig is not under /home/user, then it would be either in:
/etc/virtual/domain.com/majordomo
or somewhere in:
/var/www/html/webmail/tmp
But again, the new feature from #1 will help determine what's going on.