dovecot is moving messages to spam

[Aki Tuomi]

Hi,

you could try doveadm who and doveadm kick. These might help you out. 

Aki
> On September 28, 2016 at 4:39 PM Webert de Souza Lima <webert.boss at gmail.com> wrote:
> 
> 
> Hi Konstantin,
> 
> There is no sieve for the user (checked his dovecot mail directory, sieve
> folder is empty and there is no sieve file) and the only global sieve
> present is regarding the  X-Spam-Flag header, which is not the case.
> There is no login happening for this user and this occur, for sure.
> 
> The only thing I can imagine is some e-mail client as you said is holding
> an old connection open, previously authenticated (before I disabled his
> login) and moving the messages with some filter.
> Looking at the logs, it surely looks like an e-mail client software.
> 
> I'll take a deeper look into this.
> 
> On Wed, Sep 28, 2016 at 10:30 AM, Konstantin Khomoutov <
> flatworm at users.sourceforge.net> wrote:
> 
> > On Wed, 28 Sep 2016 10:15:25 -0300
> > Webert de Souza Lima <webert.boss at gmail.com> wrote:
> >
> > > is there any dovecot rule settings besides X-Spam-Flag header? Can it
> > > move messages via IMAP?
> > >
> > > I have a message that is being moved to spam folder after delivered
> > > in the INBOX but it has no X-Spam-Flag and it's not beeing done by
> > > the user (I changed his password, suspended his account and made his
> > > login impossible).
> > >
> > > This happens only when certain "FROM" address is present in the body,
> > > like the following message (sent via telnet):
> > [...]
> > > Sep 28 13:08:00 lmtp(my.user at my.domain): Info: OOKlA3rA61dNbwAAkzG9Ng:
> > > sieve: msgid=unspecified: stored mail into mailbox 'INBOX'
> > >
> > > Sep 28 13:08:01 imap(my.user at my.domain): Info: copy from INBOX:
> > > box=INBOX.Spam, uid=154, msgid=, size=340, subject=Test
> > >
> > > Sep 28 13:08:01 imap(my.user at my.domain): Info: expunge: box=INBOX,
> > > uid=18147, msgid=, size=340, subject=Test
> > [...]
> >
> > Are you sure there's no Sieve script active for this user?
> > (Note that there also could be a global Sieve script or scripts which
> > are executed before/after those of a user.)
> >
> > And have you really verified nothing logs into the server for sure
> > using that user's credentials (such as a Thunderbird instance with mail
> > filters enabled)?  Another thing to check is that this user's INBOX
> > folder is not shared with someone else (if at all possible).
> >