[sqwebmail] mail filtering issue

[Trey Nolen]

We've got a weird issue going on and I think it is tied to the Sqwebmail 
Maildrop filtering rules.  I have had a few people who have mail filtering 
turned on get 10's of thousands of messages overnight. They are all the same 
message, and *SHOULD* be matching one of the rules (although the rule is not 
taking effect).  When spam detection is turned off in Qmailadmin (thereby 
stopping Maildrop), they messages stop. We are using Qmailadmin 1.2.3 with 
Vpopmail 5.4.10. Enabling spam detection puts the following line in our 
.qmail files:
|preline /usr/local/bin/maildrop /etc/mailfilter

Our /etc/mailfilter file is:
VHOME=`/home/vpopmail/bin/vuserinfo -d [EMAIL PROTECTED]
VPOP="| /home/vpopmail/bin/vdelivermail '' bounce-no-mailbox"
exception {
include $VHOME/.mailfilter
}
exception {
to "$VHOME/Maildir/."
}
to "$VPOP"
We are using Spamassassin to tag messages with *****SPAM***** on the subject 
line and are instructing users to use Sqwebmail to generate rules to 
automatically move those to a Junk folder or delete the messages.   To 
delete the messages, we have users forward them to a special email address 
which goes to null.
The rule being generated by Sqwebmail and put in the .mailfilter file 
follows:

#MFMAILDROP=2
#
# DO NOT EDIT THIS FILE.  This is an automatically generated filter.
FROM='[EMAIL PROTECTED]'
import SENDER
if ($SENDER eq "")
{
SENDER=$FROM
}
##Op:contains
##Header:From
##Value:[EMAIL PROTECTED]
##Folder:[EMAIL PROTECTED]
##From:
##PlainString
##Name:spam2
if ((/^From:[EMAIL PROTECTED]/))
{
   to "| $SENDMAIL -f " '"$SENDER"' " [EMAIL PROTECTED]"
}
##Op:startswith
##Header:subject
##Value:*****SPAM*****
##Folder:[EMAIL PROTECTED]
##From:
##PlainString
##Name:spam
if ((/^subject: *\*\*\*\*\*SPAM\*\*\*\*\*/))
{
   to "| $SENDMAIL -f " '"$SENDER"' " [EMAIL PROTECTED]"
}
to "$VHOME/Maildir/."


Most of the time, these rules seem to work OK, but there have been a few 
instances where the problem mentioned above happens.  It often results in 
delivery of 1 to 4 GB of mail.  As I stated before, turning off the mail 
filter seems to stop it, so I  was wondering if there is any way that the 
above rules could somehow be perpetuating the delivery of certain emails. 
The emails that are being repeatedly delivered are tagged with 
*****SPAM***** in the subject (and the subject STARTS WITH that tag), so 
these messages should be getting forwarded to [EMAIL PROTECTED] 
Any help would be appreciated.

Trey Nolen