@TTx, the missing log entries are a clue. The directory is only consulted after the domain part of the login name resolves to a Domain object that exists in Stalwart, and that check runs first and aborts the attempt on its own. So no LDAP query is ever issued, and no store.ldap-query event can appear. That’s also why the web GUI produced entries and Thunderbird didn’t: you almost certainly logged into the GUI with a different form of the username.
Filter your trace log on auth.failed and auth.warning rather than on store.ldap-query, and look for Reason = "Domain not found" or Reason = "No domain in username". My guess is that Thunderbird is sending a bare username, or DOMAIN\user, or the AD UPN suffix rather than your mail domain. The fix is to make sure the domain exists in Stalwart and to have the client authenticate as the full user@domain that matches it.