A client of mine had his email account accessed by somebody in Nigeria (could see date and location of last login). That person then deleted everything after accessing the account.