1) How the hell did he manage to get his emails with 192.168.1.1 ?

That sounds like an anti virus proxy.

2) Why did they disapear from the server since he was using imap ?

No idea really, but the answer to 1 might help with the answer to 2

3) Is there anyway to get his old emails back ? If they have been in a Thunderbird folder and the folder has not been expunged or compacted this add-on may to it. https://nic-nac-project.org/~kaosmos/index-en.html#recDelMsg

The add-on undeletes messages, but seriously not knowing how or why they are missing it is a wild card. You perhaps should try right clicking the folder selecting properties and then the repair button, just in case it is something silly like a corrupt index (I doubt it as the server appears affected)

Thanks for your help.

The addon did not work. It's a very old thunderbird version (2 i think) that doesn't seem to have options for emails storage, at least i think so, the system is in german and i'm not really fluent.

I DID manage to get the old messages back by simply putting the old server and guessing the password. So there has to be some system between our server and thunderbird that gets those emails.

Now i'm off to find why it can't reach some e-mails on our server, probably some kind of spam filter. I'll need to get in touch with the guys who installed the whole damn thing.

Old versions of Thunderbird have serious security holes, V2 more so than some others apparently. So please encourage the user to upgrade to a later version that have security fixes. Not updating from V2 requires an update to an intermediate version (I suggest V3.1) as the profile conversion tools have been removed from current versions