The goal ist to to run mailgraph not visible for everyone by putting the mailgraph.cgi not in the webroot.
Ok, my solution in webroot is
chown webx.clientx monitor
cp mailgraph.cgi monitor
cp stats/.htaccess monitor
so I don't have to create a new .htacces file and can use the same account as for stats to login.