How does email traffic accounting work?

[ham-ster]

I'm seeing some unrealistically high reports of email traffic use on one site, and I'd like to troubleshoot it. How does ISPconfig2 do traffic accounting?

[till]

Emails are dlivered with provmail to the mailbox. When a email gets recieved, procmail measures the email size and send this size to a ispconfig script by email. This ispconfig script then writes the mail sizes to the mysql database.