dovecot Digest, Vol 160, Issue 25

[Ron Cleven]

>> >On August 23, 2016 at 6:57 PM Sam<sr42354 at gmail.com>  wrote:
>> >
>> >
>> >Hello,
>> >
>> >Sometime when we receive a spam or virus that is detected as it, mailer
>> >daemon send a reply to the sender to inform that the message is a spam
>> >or content viruses.
>> >
>> >The problem is that the sender of the spam as something like
>> >voicemail at ourdomain.fr  ( the user voicemail doesn't exist in our database )
>> >
>> >And sometimes dovecot create the directory and store the reply 's mail...
>> >
>> >

If I understand your question correctly, you are sometimes sending an 
after-the-fact bounce message based upon the return-path in at least 
some situations where you detect a spam or virus (as opposed to 
responding with an error code response during the SMTP session)?

If my understanding is correct, you should never ever ever ever ever 
ever ever send those sort of NDR's.  Please google "backscatter".