dovecot is moving messages to spam

[Konstantin Khomoutov]

On Wed, 28 Sep 2016 10:15:25 -0300
Webert de Souza Lima <webert.boss at gmail.com> wrote:

> is there any dovecot rule settings besides X-Spam-Flag header? Can it
> move messages via IMAP?
> 
> I have a message that is being moved to spam folder after delivered
> in the INBOX but it has no X-Spam-Flag and it's not beeing done by
> the user (I changed his password, suspended his account and made his
> login impossible).
> 
> This happens only when certain "FROM" address is present in the body,
> like the following message (sent via telnet):
[...]
> Sep 28 13:08:00 lmtp(my.user at my.domain): Info: OOKlA3rA61dNbwAAkzG9Ng:
> sieve: msgid=unspecified: stored mail into mailbox 'INBOX'
> 
> Sep 28 13:08:01 imap(my.user at my.domain): Info: copy from INBOX:
> box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test
> 
> Sep 28 13:08:01 imap(my.user at my.domain): Info: expunge: box=INBOX,
> uid=18147, msgid=, size=340, subject=Test
[...]

Are you sure there's no Sieve script active for this user?
(Note that there also could be a global Sieve script or scripts which
are executed before/after those of a user.)

And have you really verified nothing logs into the server for sure
using that user's credentials (such as a Thunderbird instance with mail
filters enabled)?  Another thing to check is that this user's INBOX
folder is not shared with someone else (if at all possible).