dovecot is moving messages to spam

[Webert de Souza Lima]

Hi Konstantin,

There is no sieve for the user (checked his dovecot mail directory, sieve
folder is empty and there is no sieve file) and the only global sieve
present is regarding the  X-Spam-Flag header, which is not the case.
There is no login happening for this user and this occur, for sure.

The only thing I can imagine is some e-mail client as you said is holding
an old connection open, previously authenticated (before I disabled his
login) and moving the messages with some filter.
Looking at the logs, it surely looks like an e-mail client software.

I'll take a deeper look into this.

On Wed, Sep 28, 2016 at 10:30 AM, Konstantin Khomoutov <
flatworm at users.sourceforge.net> wrote:

> On Wed, 28 Sep 2016 10:15:25 -0300
> Webert de Souza Lima <webert.boss at gmail.com> wrote:
>
> > is there any dovecot rule settings besides X-Spam-Flag header? Can it
> > move messages via IMAP?
> >
> > I have a message that is being moved to spam folder after delivered
> > in the INBOX but it has no X-Spam-Flag and it's not beeing done by
> > the user (I changed his password, suspended his account and made his
> > login impossible).
> >
> > This happens only when certain "FROM" address is present in the body,
> > like the following message (sent via telnet):
> [...]
> > Sep 28 13:08:00 lmtp(my.user at my.domain): Info: OOKlA3rA61dNbwAAkzG9Ng:
> > sieve: msgid=unspecified: stored mail into mailbox 'INBOX'
> >
> > Sep 28 13:08:01 imap(my.user at my.domain): Info: copy from INBOX:
> > box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test
> >
> > Sep 28 13:08:01 imap(my.user at my.domain): Info: expunge: box=INBOX,
> > uid=18147, msgid=, size=340, subject=Test
> [...]
>
> Are you sure there's no Sieve script active for this user?
> (Note that there also could be a global Sieve script or scripts which
> are executed before/after those of a user.)
>
> And have you really verified nothing logs into the server for sure
> using that user's credentials (such as a Thunderbird instance with mail
> filters enabled)?  Another thing to check is that this user's INBOX
> folder is not shared with someone else (if at all possible).
>