All email accounts started to show failed login error messages

[albatroz]

Today suddenly all email accounts in my CPanel server
started to show a failed error message, so I am starting to change
the passwords of some accounts.
However I can't change all the passwords!

What may have happened?

 

[kodeslogic]

Any error in /var/log/maillog ?

 

[albatroz]

It seems that the CPanel account was compromised and someone deleted the accounts.
Now I am trying to restore the accounts on a blank new server but we are receiving these error messages after
we changed back the DNS settings
dovecot: pop3-login: Aborted login (proxy dest auth failed):

 

[SamA]

Hey @albatroz !

Are you able to clarify how the restore was performed (whether it was a cPanel backup restore or a manual collection of files and transferred). Additionally, are you also able to provide the full error shown when attempting to access these email accounts over the webmail interface?

Thanks!