Figured it out. On saving the preferences in Sogo (when you click the Save button after setting up “ Forward incoming messages”, the settings are saved in table sogo_user_profile, column c_defaults. At the same time, Sogo makes a connection to the managesieve service, which is a part of dovecot (runs in the dovecot container). The sieve settings are then stored by dovecot in the docker volume mailcowdockerized_vmail-vol-1, in [domain]/[username]/sieve/sogo.sieve. In default docker configuration, you will find it in /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/[domain]/[username]/sieve/sogo.sieve.
Deleting the forward here in the sieve config file immediately disables it. However, next time user enters the mail settings in sogo, the state is loaded from the sogo database, and by clicking Save, users would again create that forward rule.
Therefore, it is also necessary to delete the Forward key from the json stored in the c_defaults column of sogo_user_profile. It looks like this: "Forward": {"forwardAddress": ["frantisek@greensteps.com.cn"], "enabled": 1, "keepCopy": 0}. This can be tricky: The column is of longtext type, so you (afaik) can’t directly update a value in the stored json (like you could do in postgres when using the jsonb data type), so you have to copy the whole json out, delete what you need to delete, and then update the column with the edited content. For some characters in some users’ signatures, mysql console understood them as newlines, which immediately sent the query, before it was finished…
Fortunately I found out that the forward I needed to get rid of was set for the whole domain.