Could have been the reason indeed. But I tried again with another user and another email. Not working.
Logs filtered on the sender email (sender@email.be) to testuser@lebrass.be and admin@lebrass.be :
2025-08-20T14:16:34+02:00 [6:mail4:rspamd] (normal) <19C7C1>; task; rspamd_task_write_log: id: <DDF47003-B71D-45FE-8AD0-B11B8996C3EE@gaillet.be>, qid: <19C7C1300BDE>, ip: 5.75.170.204, from: <sender@email.be>, (default: F (no action): [0.64/20.00] [URI_COUNT_ODD(1.00){1;},R_MIXED_CHARSET(0.75){},DMARC_POLICY_ALLOW(-0.50){gaillet.be;none;},R_DKIM_ALLOW(-0.20){gaillet.be:s=default;},R_SPF_ALLOW(-0.20){+ip4:5.75.170.204:c;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},BAYES_HAM(-0.10){65.39%;},MX_GOOD(-0.01){},APPLE_MAILER_COMMON(0.00){},ARC_NA(0.00){},ASN(0.00){asn:24940, ipnet:5.75.128.0/17, country:DE;},DKIM_TRACE(0.00){gaillet.be:+;},FROM_EQ_ENVFROM(0.00){},FROM_NO_DN(0.00){},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:+;2:~;},NEURAL_HAM(0.00){-0.961;},PREVIOUSLY_DELIVERED(0.00){testuser@lebrass.be;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ONE(0.00){1;},RCVD_TLS_ALL(0.00){},RCVD_VIA_SMTP_AUTH(0.00){},RECEIVED_SPAMHAUS_PBL(0.00){81.247.163.120:received;},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 7703, time: 1055.924ms, dns req: 43, digest: <9601c2147a3af5c5d4afd6217e5b1d6e>, rcpts: <testuser@lebrass.be>, mime_rcpts: <testuser@lebrass.be>
2025-08-20T14:16:34+02:00 [6:mail4:postfix/qmgr] 19C7C1300BDE: from=<sender@email.be>, size=8127, nrcpt=1 (queue active)
2025-08-20T14:16:34+02:00 [6:mail4:rspamd] (normal) <3FBEA1>; task; rspamd_task_write_log: id: <dovecot-sieve-1755692194-242532-0@mail.your-server.de>, qid: <3FBEA1300E73>, ip: 127.0.0.1, (default: F (no action): [-0.10/20.00] [MIME_GOOD(-0.10){text/plain;},ARC_NA(0.00){},DKIM_SIGNED(0.00){lebrass.be:s=default;},FROM_NO_DN(0.00){},MIME_TRACE(0.00){0:+;},MISSING_XM_UA(0.00){},NEURAL_HAM(0.00){-0.552;},PRECEDENCE_BULK(0.00){},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},SINGLE_SHORT_PART(0.00){},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 669, time: 394.667ms, dns req: 9, digest: <53f8ec7f502b76adbfc8ee71d961e9a1>, rcpts: <sender@email.be>, mime_rcpts: <sender@email.be>
2025-08-20T14:16:35+02:00 [6:mail4:dovecot] lmtp(testuser)<541144><GBhODqK8pWjYQQgACApylw>: sieve: msgid=<DDF47003-B71D-45FE-8AD0-B11B8996C3EE@gaillet.be>: vacation action: sent vacation response to <sender@email.be>
2025-08-20T14:16:35+02:00 [6:mail4:postfix/smtp] 3FBEA1300E73: to=<sender@email.be>, relay=in-v3.mailjet.com[34.22.188.249]:587, delay=1.2, delays=0.84/0.01/0.15/0.15, dsn=5.0.0, status=bounced (host in-v3.mailjet.com[34.22.188.249] said: 501 Syntax error in parameters or arguments (in reply to RCPT TO command))
2025-08-20T14:16:35+02:00 [6:mail4:dovecot] lmtp(testuser)<541144><GBhODqK8pWjYQQgACApylw>: save: box=INBOX, uid=32, msgid=<DDF47003-B71D-45FE-8AD0-B11B8996C3EE@gaillet.be>, from=sender@email.be, subject=Fwd: [NethServer] [Support] NS8 / SOGo : vacation message not working, flags=()
2025-08-20T14:16:49+02:00 [6:mail4:rspamd] (normal) <696651>; task; rspamd_task_write_log: id: <AC234AB2-01D9-4667-86BC-8A3CEC912659@gaillet.be>, qid: <696651300E78>, ip: 5.75.170.204, from: <sender@email.be>, (default: F (no action): [0.65/20.00] [URI_COUNT_ODD(1.00){3;},R_MIXED_CHARSET(0.82){},DMARC_POLICY_ALLOW(-0.50){gaillet.be;none;},R_DKIM_ALLOW(-0.20){gaillet.be:s=default;},R_SPF_ALLOW(-0.20){+ip4:5.75.170.204:c;},BAYES_HAM(-0.15){69.13%;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},MX_GOOD(-0.01){},APPLE_MAILER_COMMON(0.00){},ARC_NA(0.00){},ASN(0.00){asn:24940, ipnet:5.75.128.0/17, country:DE;},DKIM_TRACE(0.00){gaillet.be:+;},FROM_EQ_ENVFROM(0.00){},FROM_NO_DN(0.00){},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:+;2:~;},NEURAL_HAM(0.00){-0.964;},PREVIOUSLY_DELIVERED(0.00){admin@lebrass.be;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ONE(0.00){1;},RCVD_TLS_ALL(0.00){},RCVD_VIA_SMTP_AUTH(0.00){},RECEIVED_SPAMHAUS_PBL(0.00){81.247.163.120:received;},TO_DN_ALL(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 10062, time: 502.856ms, dns req: 44, digest: <dce50fc1fc08c8565247bf80e75599a2>, rcpts: <admin@lebrass.be>, mime_rcpts: <admin@lebrass.be>
2025-08-20T14:16:50+02:00 [6:mail4:postfix/qmgr] 696651300E78: from=<sender@email.be>, size=10483, nrcpt=2 (queue active)
2025-08-20T14:16:50+02:00 [6:mail4:dovecot] lmtp(admin)<541144><6Hp4AbK8pWjYQQgACApylw>: save: box=INBOX, uid=48787, msgid=<AC234AB2-01D9-4667-86BC-8A3CEC912659@gaillet.be>, from=sender@email.be, subject=Fwd: [NethServer] [Support] NS8 / SOGo : vacation message not working, flags=()
2025-08-20T14:16:50+02:00 [6:mail4:dovecot] lmtp(quentin.velghe)<541144><6Hp4AbK8pWjYQQgACApylw:R2>: save: box=INBOX, uid=114240, msgid=<AC234AB2-01D9-4667-86BC-8A3CEC912659@gaillet.be>, from=sender@email.be, subject=Fwd: [NethServer] [Support] NS8 / SOGo : vacation message not working, flags=()
Notice the lmtp(quentin.velghe)
which is extremely strange because that user isn’t involved !