First thing — check /usr/local/cpanel/logs/login_log
If you see a line like:
208.74.121.102 - name@domain.com [10/01/2009:17:21:12 -0000] "POST
/login/ HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing
from system (user probably does not exist)
Check /home/USER/etc/DOMAIN/shadow to make sure that the webmail user is listed there. If not, copy one of the lines, change the username, and reset the password via cPanel.
