Audit mail usage

I'm busy writing a script to audit a specific domains email usage.

I can see who the top bandwidth users, but noticed a discrepancy. In cPanel for the 3rd of February the entire domain used 471.23 MB via IMAP.

Yet in the logs:

Code:

# zgrep "^Feb  3" /var/log/maillog-20160207.gz | awk '/dovecot: imap/ && /example.com/ && /bytes=/ {print $NF}' | sed -e 's/bytes=//' -e 's/\// /' | awk '{sum+=$1+$2} END {print sum}'
2336787930

That's almost a 2GB difference.

Checking the 4th and there's about a 700MB difference with the logs being higher.

5th there's about a 800MB difference with the logs being higher.

What am I misunderstanding or is there something wrong?