Sieve filtering
A Sieve filter is a sorting rule: "put receipts in the Receipts folder", a vacation reply, a move based on the subject. A filter belongs to one mailbox, not to your account.
Sieve acts on mail the server has already accepted. Whether a message is spam is decided first, by the spam filter.
Users manage their filters from the filter settings in webmail. The rules run on the server at delivery, so they apply to every client that reads the mail later.
What you can do from the panel
The panel deliberately lets you see the filters, not edit them. The Sieve Filtering page of a domain user shows:
- the active script
- its recent log
- one action: Remove
A hidden filter that forwards or deletes mail is a classic way for an attacker to keep access to a compromised mailbox: it survives every password change.
Removal is one of the lockdown measures. Also check the script whenever a user reports mail disappearing with no error.
You can turn off Sieve access, the protocol a client uses to edit the filters, for one domain user in the Email Access Policy.