Standard UNIX accounting facilities can be used to expose the culprit. Local users cannot access the content of other user's Postfix maildrop queue files. When a queue file has more than one hard link, Postfix deletes the hard link, and logs a warning. When the hard link count reaches 1, Postfix delivers the mail. Standard UNIX accounting facilities can be used to expose the culprit.
Postfix deletes the hard link in the maildrop queue directory, and logs a warning.
In addition to this, Postfix queue files have a very specific file format that is produced by no other software, and Postfix insists that queue file records be written in a very specific order. Postfix deletes queue files that do not satisfy all requirements. Standard UNIX accounting facilities can be used to expose the culprit. Postfix uses the queue file numerical uid for logging purposes only. Standard UNIX accounting facilities can be used to expose the real culprit.