On Wed, Mar 04, 2015 at 11:57:52PM +1100, James Brown wrote:
> Just had one today. It was originally sent on 26 Feb, the wrong user just had
> it delivered today.
Are you sure it is the same message?
> Mar 4 22:15:15 mail postfix/smtpd[53229]: connect from localhost[127.0.0.1]
Find the *upstream* logs, what's connecting to 127.0.0.1? Look
for 279374563492 or the message-id in log entries that deliver email
to 127.0.0.1.
> Mar 4 22:15:15 mail postfix/cleanup[53149]: 279374563492:
> message-id=<20150226073917.0001.CanonTxNo.4122@[192.168.1.78]>
> Mar 4 22:15:15 mail postfix/qmgr[122]: 279374563492:
> from=<scan...@bordo.com.au>, size=40758, nrcpt=1 (queue active)
>
> This was the mail originally being sent:
>
> Feb 26 09:40:46 mail postfix/smtpd[93571]: connect from localhost[127.0.0.1]
> Feb 26 09:40:47 mail postfix/smtpd[93571]: 2DC2644E6BCB:
> client=localhost[127.0.0.1], sasl_method=PLAIN,
> sasl_username=scan...@bordo.com.au
Perhaps a copy of the message was quarantined and released (to a
different address) later. Or the content filter sent the wrong
message content for a new envelope.
> Feb 26 09:40:48 mail postfix/cleanup[93574]: 2DC2644E6BCB:
> message-id=<20150226073917.0001.CanonTxNo.4122@[192.168.1.78]>
> Feb 26 09:40:48 mail postfix/qmgr[6200]: 2DC2644E6BCB:
> from=<scan...@bordo.com.au>, size=40950, nrcpt=1 (queue active)
Note the slightly different message size this time.
Hard to know what's going on without the input-side (pre-filter)
logging.
--
Viktor.
