[deleted] I don't think there is anything relevant in syslog. I've have created a few users the last hour.
The are the last few lines in the log:
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[1]: Created slice User Slice of root.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[1]: Starting User Manager for UID 0...
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[1]: Started Session 33 of user root.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[21655]: Reached target Paths.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[21655]: Reached target Timers.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[21655]: Reached target Sockets.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[21655]: Reached target Basic System.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[21655]: Reached target Default.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[21655]: Startup finished in 23ms.
Feb 24 18:45:37 ubuntu-1gb-fra1-01 systemd[1]: Started User Manager for UID 0.
Feb 24 18:54:18 ubuntu-1gb-fra1-01 systemd[1]: Started Session 34 of user root.
Feb 24 18:54:18 ubuntu-1gb-fra1-01 systemd[1]: Started Session 35 of user root.
I will try and find mail.log.