As I see the following issue is by design, not a bug. But we need some support on it.
We use SendMail as mail engine with MIMEDefang for the ability of domain-selective relay-filtering. Think this can be an important information.
When on a virtual server I set up Edit Mail and FTP Users » » Mail forwarding settings » Forward to other addresses: Yes, forward to addresses or Send automatic reply: Yes, respond with message .. the spam (and - maybe - virus) filtering does not work for incoming e-mails before automatic forwarding or automatic reply. Filtering just work when Deliver to this user normally: Yes, deliver to mailbox and effects only the mailbox direction. I think this happens because incoming e-mails are forwarded or replied before procmailing to SpamAssassin as in SendMail Aliases table. (And - maybe - virus filtering also does not apply this case.) As I see in the code this is by design.
The problem is that not just the needed messages but also all the spam forwarded and/or replied without any attention and - our IP-address continuously blacklisted as a spammer host. - as other e-mail addresses in the same domain trust this mailbox they get the spam autoreplies unfiltered.
The workaround this issue to make the needed setup by Usermin account of the mailbox user, but it needs separate login and this does not the central administration what we and our resellers need.
I know that with Virtualmin 3.62 you've "Added a button to the Edit Mailbox page for logging into Usermin as a user without having to enter their password. Requires Webmin 1.440 or later though.", but we really never did know where is it even when with Virtualmin 3.67 you've "Added a Module Config option to disallow switching to Usermin as a mailbox user by domain owners." and the System Settings » Module Config » Server adminisrator permissions » Allow logins to Usermin as mailboxes?: Yes enabled.
Please help us to resolve this problem.
And - if you can - please tell us the reason of designing central and user e-mail automatic forwarding and reply administration and flow pipeline on a different way.
Many thanks and greetings.
Gergo Giczy Hungary/EU