thanks for your reply.
agree with you that the settings I mentioned are for dovecot, so any password request that hits dovecot should produce an entry…
In the meantime I troubleshooted this a bit more and realized that the settings work, noticeably for example after a fresh start, i.e. docket compose down / up -d
After a restart, as devices/clients reconnect to their service, log entries are produced. After that I think dovecot caching takes over and no further entries are created.
As far as brute-force efforts go from hackers: I get entries for incorrect login attempts when a correct mailbox username/email is used.
Nothing seems to be recorded in the dovecot logs if an incorrect username is used, such as one with no domain, or email that is only exists as an alias.
I am guessing that this is by design and not due to an error or configuration.
I browsed a bit github commits since about January but could not readily identify anything which deals with logging or log_debug