Is there a proper way to torture doveadm search query to look for messages with a missing "To:" header? I played around with it and this seems to work:

doveadm fetch -A text mailbox {box} NOT TO ''

(Looking through a large spam corups: spam often exclude recipients in the headers as it gives the game away their personalized fraud was blasted to hundreds of addresses.)

Joseph Tam <jtam.home@gmail.com>