Emails with this subject seem to occur when our ISP changes our IP address. Its most annoying since users get told "Your account user.name@domain.com was recently accessed via IMAP. The Time, IP and location details of the activity are available below:
TIME Fri Nov 20 18:39:50 2020
IP 41.162.70.245
LOCATION Port louis, MU"

Which makes them think some hacker logged in. But that IP address belongs to our local ISP in Harrismith South Africa. Mauritius is 3000km from here.

Why does ZOHO think this IP is in Mauritius?