We've got a weird issue going on and I think it is tied to the Sqwebmail Maildrop filtering rules. I have had a few people who have mail filtering turned on get 10's of thousands of messages overnight. They are all the same message, and *SHOULD* be matching one of the rules (although the rule is not taking effect). When spam detection is turned off in Qmailadmin (thereby stopping Maildrop), they messages stop. We are using Qmailadmin 1.2.3 with Vpopmail 5.4.10. Enabling spam detection puts the following line in our .qmail files: |preline /usr/local/bin/maildrop /etc/mailfilter

Our /etc/mailfilter file is: VHOME=`/home/vpopmail/bin/vuserinfo -d $EXT@$HOST` VPOP="| /home/vpopmail/bin/vdelivermail '' bounce-no-mailbox"

exception { include $VHOME/.mailfilter }

exception { to "$VHOME/Maildir/." }

to "$VPOP"

We are using Spamassassin to tag messages with *****SPAM***** on the subject line and are instructing users to use Sqwebmail to generate rules to automatically move those to a Junk folder or delete the messages. To delete the messages, we have users forward them to a special email address which goes to null. The rule being generated by Sqwebmail and put in the .mailfilter file follows:

#MFMAILDROP=2 # # DO NOT EDIT THIS FILE. This is an automatically generated filter.

FROM='user@mail' import SENDER if ($SENDER eq "") { SENDER=$FROM }

##Op:contains ##Header:From ##Value:lqar...@3dmania.it ##Folder:!blac...@internetpro.net ##From: ##PlainString ##Name:spam2

if ((/^From:.*lqarjvgwdk\@3dmania\.it/)) { to "| $SENDMAIL -f " '"$SENDER"' " blac...@internetpro.net" }

##Op:startswith ##Header:subject ##Value:*****SPAM***** ##Folder:!blac...@internetpro.net ##From: ##PlainString ##Name:spam

if ((/^subject: *\*\*\*\*\*SPAM\*\*\*\*\*/)) { to "| $SENDMAIL -f " '"$SENDER"' " blac...@internetpro.net" }

to "$VHOME/Maildir/."

Most of the time, these rules seem to work OK, but there have been a few instances where the problem mentioned above happens. It often results in delivery of 1 to 4 GB of mail. As I stated before, turning off the mail filter seems to stop it, so I was wondering if there is any way that the above rules could somehow be perpetuating the delivery of certain emails. The emails that are being repeatedly delivered are tagged with *****SPAM***** in the subject (and the subject STARTS WITH that tag), so these messages should be getting forwarded to blac...@internetpro.net. Any help would be appreciated.