if you want to prove that this person did whatever they have allegedly done, you need a chain of events that proves he/she has done this.. since this is an email server he/she logged on to, you start with the mail server logs where connections from various clients are logged.. It would also count in your favour if there are log files that detail the alleged offense and ties it to your suspect IP address.. if this person is tech savvy enough, they could have used any number of means to try and disguise themselves and hide their actual IP address.. if this is the case, you will need someone that knows what to look for in the relevant log files to try and trace back to the actual source IP address..
How do you know he/she was trying to disguise themselves..? The whois lookup will tell you.. You are looking for the details of a SA based ISP on the whois lookup and a description that states the IP address is for DSL or ADSL or Dynamic use, which means the person connected from their home internet..
Provided that he/she has connected to the mail server from his/her home over the internet, you can then do a whois lookup of the suspected IP address.. Once you have the ISP(if they weren't disguising themselves) who owns the IP address, you take that information along with all your, hopefully tangible, evidence and ask SAPS to issue a subpoena to the ISP who owns the IP address.. The ISP will then provide you with the details of the person who the IP address was assigned to at the time the alleged offense was committed..
Also, if you are going to court, do you have an attorney..? Any attorney worth his/her salt should know the procedure to obtain details of IP address owner etc..
