Hi Jeff - I think this is the same problem I ran into about a month ago, and it turned out that the user in my case had just tried to send a large mass-mailing, which triggered HiJack to flag their IP address and hold their messages. If you look at console.txt file in the Declude folder, you might see the IP address in there.
Todd -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Hitchcock Sent: Thursday, April 20, 2006 7:01 AM To: [email protected] Subject: [IMail Forum] User's sent mail all marked as spam but not One of my users is able to receive email fine but all of her messages end up in the /imail/spool/spam directory. Oddly, I cannot find out how these messges are getting there. iMail 8.22 Declude 3.1 One message is in /imail/spool/spam/hold2 as: 65.100.200.244IP.b61623e2.D6e97019d00002f02.smd 65.100.200.244IP.b61623e2.q6e97019d00002f02.smd Searching all log files for that day (April 19), I find the message number onlin in the log0419.txt and vir0419.txt: log0419.txt:20060419 130839 127.0.0.1 SMTPD (6e97019d00002f02) [216.68.227.90] connect 65.100.200.244 port 1905 log0419.txt:20060419 130839 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] EHLO RODGERSHP log0419.txt:20060419 130840 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] AUTH log0419.txt:20060419 130840 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] AUTH log0419.txt:20060419 130840 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] AUTH log0419.txt:20060419 130840 127.0.0.1 SMTPD (6e97019d00002f02) Authenticated [user], session treated as local. log0419.txt:20060419 130840 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] MAIL FROM: <[user]> log0419.txt:20060419 130840 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] RCPT TO: <[EMAIL PROTECTED]> log0419.txt:20060419 130840 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] DATA log0419.txt:20060419 130841 127.0.0.1 SMTPD (6e97019d00002f02) [65.100.200.244] d:\IMail\spool\D6e97019d00002f02.SMD 1449 vir0419.log:04/19/2006 13:08:45.437 q6e97019d00002f02.smd Vulnerability flags = 0 vir0419.log:04/19/2006 13:08:45.452 q6e97019d00002f02.smd Virus scanner 1 reports exit code of 0 vir0419.log:04/19/2006 13:08:45.452 q6e97019d00002f02.smd Scanned: Virus Free [MIME: 1 709] So the user connected and authenticated, message was received, message written to the spool directory, Declude scanned for virus and found nothing. The message id does not appear in the Declude anti-spam log (dec0419.log), nor does it appear in the iMail anti-spam log (spam0419). To confirm, the content of the message is totally benign - one mom emailing another about birthday cupcakes. Any ideas? Jeff Hitchcock - [EMAIL PROTECTED] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
