The POP3 RFCs explicitly allow a client to leave mail on a server, but warn that it will lead to the buildup of mail, and encourage clients to send explicit delete commands after getting email, and encourage administrators to consider site-wide retention policies to delete email some time after it has been read.
In short it's not the protocol. Either your client is sending the DELE command to delete mail, maybe after a few days, or your server has a site-policy to delete mail which has been read by POP3 after some time. Neither behavior is mandated by the POP3 protocol, though.
https://www.rfc-editor.org/rfc/rfc1939 "Post Office Protocol - Version 3" includes:
- The UPDATE State
When the client issues the QUIT command from the TRANSACTION state, the POP3 session enters the UPDATE state. The POP3 server removes all messages marked as deleted from the maildrop [..] In no case may the server remove any messages not marked as deleted.
If a session terminates for some reason other than a client-issued QUIT command, the POP3 session does NOT enter the UPDATE state and MUST not remove any messages from the maildrop.
(emphasis mine)
and
- Scaling and Operational Considerations
Since some of the optional features described above were added to the POP3 protocol, experience has accumulated in using them in large-scale commercial post office operations where most of the users are unrelated to each other. In these situations and others, users and vendors of POP3 clients have discovered that the combination of using the UIDL command and not issuing the DELE command can provide a weak version of the "maildrop as semi-permanent repository" functionality normally associated with IMAP.
[..]
When these facilities are used in this way by casual users, there has been a tendency for already-read messages to accumulate on the server without bound. This is clearly an undesirable behavior pattern from the standpoint of the server operator. This situation is aggravated by the fact that the limited capabilities of the POP3 do not permit efficient handling of maildrops which have hundreds or thousands of messages.
Consequently, it is recommended that operators of large-scale multi-user servers, especially ones in which the user's only access to the maildrop is via POP3, consider such options as: [..]
Enforce a site policy regarding mail retention on the server.
Sites are free to establish local policy regarding the storage and
retention of messages on the server, both read and unread. For
example, a site might delete unread messages from the server after
60 days and delete read messages after 7 days. Such message
deletions are outside the scope of the POP3 protocol and are not
considered a protocol violation.
Server operators enforcing message deletion policies should take
care to make all users aware of the policies in force.
Clients must not assume that a site policy will automate message
deletions, and should continue to explicitly delete messages using
the DELE command when appropriate.
and
https://www.rfc-editor.org/rfc/rfc2449
Discussion:
While POP3 allows clients to leave messages on the server, RFC
1939 [POP3] warns about the problems that may arise from this,
and allows servers to delete messages based on site policy.