Hi folks!
I have a strange situation:
My mailcow installation is dockerized and its containers get updated from time to time by watchtower.
I am making backups of all volumes on a daily basis.

3 days ago, in - as far as i can see - just ONE mailbox the number of mails in its main /cur dropped from 8000+ to around 700 back from in the year 2013 beeing the newest mail. Subfolders are not affected.

I have no clue how those mails vanished - deleting that via the webinterface would be a lot of work :-)

So I copied those 8000 files back to the folder where they were before.

shutdown the system with docker-compose down
copy the mailfiles back to /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/domain/user/Maildir/cur/
chown -R 5000:5000 everything in that cur folder
docker-compose up -d

Then, ls | wc -l shows around 8000 files… but then suddenly starts to drop again!

The log of the dovecot container shows:
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52529, msgid=, size=5330 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52530, msgid=, size=41249 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52531, msgid=, size=88115 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52532, msgid=, size=88580 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52533, msgid=, size=18284 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52534, msgid=, size=144868 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52535, msgid=, size=12889 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52536, msgid=, size=13792 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52537, msgid=, size=2968 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52538, msgid=, size=10040 Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52539, msgid=, size=11757

So I am asking: what process is expunging those mails - and where is it configured / triggered?

any hint is highly appreciated!