When this occurs, is there a specific theme users are being changed to? What theme is it?
They talk to me about the login page was different from the habitual page from them, so I suppose that login page belong to the theme which changed at.
Most likely what is happening is a different login page is being loaded, which would mean the Theme selection on the login page is probably also different. The most likely reason this occurs is because the user changed to a different theme the last time they signed in, and then signed out. Please have users verify the theme they are logged in with prior to logging out, and have the users verify the correct theme is selected on the login page before clicking the button to login.
Sorry, what I should looking for in the webmail log?
Login attempts when the user was logged into a different theme than they wanted. My guess is that its going to show a different theme was selected than what they wanted.
It might also be helpful to see details from the user's previous session. If you can send me a couple days of webmail logs along with details for a couple of users that had the issue in those days, I can look through the logs.
In the User.ini file found in the \MDaemon\Users\$DOMAIN$\$MAILBOX$\WC\ directory, what value is set for "Theme"?
What theme is configured under Setup / Domain Mangaer / $Domain$ / Webmail?
It is not going to fix your issue, but I'd suggest setting the Theme here to be your preferred theme. The Standard theme is no longer available, which is why the field is blank.