dovecot - Mar 2010 - Emails Disappearing -- Mystery

I got a case that I haven't  been able to resolve. I  hope somebody can 
give me some hints.

One of our users is reporting emails disappearing in front of his eyes,  
(Right ...  emails filters at the client side ....)

Server does not have global sieve filter enabled (no file present), even 
though this configuration is present:
   sieve_global_path=/vmail/globalsieverc

User does not have any sieve scripts enabled at the server side.

Ok,

1)
The user shuts down his apple mail software, his Iphone, and the Web 
interface:

2010-03-11 15:52:57 IMAP(my_user at mydomain.com): Info: Connection closed 
bytes=2188/6499
2010-03-11 15:52:57 IMAP(my_user at mydomain.com): Info: Connection closed 
bytes=3887/7336
2010-03-11 15:52:57 IMAP(my_user at mydomain.com): Info: Connection closed 
bytes=5873/68309
2010-03-11 15:52:57 IMAP(my_user at mydomain.com): Info: Disconnected in 
IDLE bytes=4514/547136

2)
He generates the troublesome emails from a notification system in 
Craiglist ....
We can see the email hitting the inbox (we also see in Postfix this 
email going to Dovecot)
2010-03-11 15:54:48 deliver(my_user at mydomain.com): Info: 
From=noreply at craigslist.org : 
msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org> : saved
mail
to INBOX

3)
Email is deleted !!!
2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: delete: uid=10719, 
flags=(\Deleted \Recent $Junk),
msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
from=craigslist.org <noreply at craigslist.org>, subject=POST/EDIT/DELETE
:
(accounting/financejobs) Test Post
2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: expunge: 
uid=10719, flags=(\Deleted \Recent $Junk),
msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
from=craigslist.org <noreply at craigslist.org>, subject=POST/EDIT/DELETE
:
(accounting/finance jobs) Test Post , size=2776

Who is deleting this email ?
I can see the flag $Junk ... perhaps some filter somewhere is seeing 
that flag and proceeding to delete it.
If I understand sieve filters at the server side, they will act in the 
deliver process. So once the email is saved into INBOX,  sieve filters 
will not count. Am I right?

Any Hints?

# 1.2.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.26-2-686-bigmem i686 Debian 5.0.4 xfs


Regards,

Mario Antonio

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 11 Mar 2010, Mario Antonio wrote:
> 1)
> The user shuts down his apple mail software, his Iphone, and the Web 
> interface:
OK, but are you _sure_ that no other user / connection accesses the 
mailbox?
> 2)
> 2010-03-11 15:54:48 deliver(my_user at mydomain.com): Info: 
> From=noreply at craigslist.org : 
> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org> :
saved mail to
> INBOX
OK, Sieve has been processed now, Postfix & Dovecot are done with the 
message.
> 3)
> Email is deleted !!!
> 2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: delete: uid=10719,
> flags=(\Deleted \Recent $Junk),
> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
> from=craigslist.org <noreply at craigslist.org>,
subject=POST/EDIT/DELETE :
> (accounting/financejobs) Test Post
> 2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: expunge:
uid=10719,
> flags=(\Deleted \Recent $Junk),
> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
> from=craigslist.org <noreply at craigslist.org>,
subject=POST/EDIT/DELETE :
> (accounting/finance jobs) Test Post , size=2776
>
> Who is deleting this email ?
> I can see the flag $Junk ... perhaps some filter somewhere is seeing that 
> flag and proceeding to delete it.
There is another MUA monitoring this mailbox.
It does not seem to be Thunderbird, as it seems to use the "Junk"
keyword.

I think you can use tools like "fuser" or "lsof" on the
index of the
user's INBOX to get the pid of the process. Dunno if there are tools to 
detect inotify/epoll/etc. on a directory.

Regards,

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBS5n8dL+Vh58GPL/cAQLcGAgAseTfkuExZTSy0Ma13Wdti7CrXq3DH2Kf
tGfXsEDiaQOA02jmk20GcnnDZAjxyoBFYPOQ5dqBLSUE/5IaTnXPzZV0WPIWn4nY
MyOQxYuVmiMOf29gjhzRb0hZLtNq/aJ0zeMTqv2E6NtY7iH/wJ3g7RSYW5116Awz
v5ITpa8X1PwSuQS4SidFQbsgGU7kO6sqDUBnHY3dUX9p0kpdawTk4L/j2U7etFQY
JWT79PLcZWL/fGLPkz8UQmeGT7zvI4YfrwDp93k8qHcbgrDkjt0WuWk+DLvJcZqR
pFEhNw99kZ4AeYq3cqsAZDeQ/gAXu0IGd5wOsiyXuIp8d+/NJUxtgA==wWcG
-----END PGP SIGNATURE-----