Get which users it's trying to access attempt via smtp or SoGo

[Edig]

Summary

It's there any way to get which user it's trying to attempt the login that netfiler bann the ip.

In the company a user (we don't know who) try a lot of times to login with a bad password, but we don't know who is it (also we have some sisters that connect via smtp to the email).

In the log of netfiler I only see the "login attempt" But I would like which user try it.

Motivation

To get better admin , while whitelisting or blacklisting the Ip's

Additional context

BTW that IP is the one that the ISP assign us (it's not static ip, it changes every 3-4 hours)