Вырос спам в ящики пользователей

#размер письма
message_size_limit = 41943040
queue_directory = /var/spool/postfix
config_directory = /etc/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/db/postfix
mail_owner = postfix
#myhostname = mail.gb2bel.ru
myhostname = mx0.gb2bel.ru
mydomain = gb2bel.ru
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4
#mydestination = $myhostname, localhost.$mydomain, localhost
mydestination = $myhostname localhost.$mydomain localhost
#relay_domains = 
local_recipient_maps = unix:passwd.byname $alias_maps
unknown_local_recipient_reject_code = 550
mynetworks_style = host
###########
mynetworks = 127.0.0.0/8, 172.16.5.5/32 
############
#mynetworks=
###########
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
#smtpd_banner = MHI Belgorod City Hospital 2 ESMTP server
smtpd_banner = mx0.gb2bel.ru
debug_peer_level = 2
sendmail_path = /usr/sbin/sendmail
newaliases_path = /bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = mail
html_directory = no
manpage_directory = /usr/share/man
readme_directory = no
# Указываем базовый путь, где будут лежать наши почтовые ящики.
virtual_mailbox_base = /var/spool/mail/
# Укажим путь где будут храниться у нас алисы пользователей.
virtual_alias_maps = proxy:pgsql:/etc/postfix/pgsql_virtual_alias_maps.cf
# Даем понять почтовому серверу какие он домены должен обслуживать.
virtual_mailbox_domains = proxy:pgsql:/etc/postfix/pgsql_virtual_domains_maps.cf
# Укажим путь до файла, где прописаны названия виртуальных почтовых ящиков и соответствующие им относительные пути до почтовых хранилищ.
virtual_mailbox_maps = proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_maps.cf
virtual_minimum_uid             = 65534
virtual_uid_maps                = static:65534
virtual_gid_maps                = static:65534
virtual_transport               = dovecot
dovecot_destination_recipient_limit = 1
#Размер почтового ящика
mailbox_size_limit = 524288000
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc
########
#smtpd_etrn_restrictions = reject
#######
#smtputf8_enable = yes
#smtputf8_autodetect_classes = all
smtp_always_send_ehlo = yes
smtpd_reject_unlisted_sender = yes
smtpd_reject_unlisted_recipient = yes
smtpd_helo_required = yes
strict_rfc821_envelopes = yes
invalid_hostname_reject_code = 554
multi_recipient_bounce_reject_code =554
non_fqdn_reject_code = 554
relay_domains_reject_code = 554
unknown_address_reject_code = 554
unknown_client_reject_code = 554
unknown_hostname_reject_code = 554
unknown_relay_recipient_reject_code = 554
unknown_sender_reject_code = 554
unknown_virtual_alias_reject_code = 554
unknown_virtual_mailbox_reject_code = 554
unverified_recipient_reject_code = 554
unverified_sender_reject_code = 554
disable_vrfy_command = yes
#smtpd_hard_error_limit = 2
smtpd_recipient_limit = 40
bounce_queue_lifetime = 1d
maximal_queue_lifetime = 3d
smtpd_sasl_auth_enable = yes
#smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
##
smtpd_sasl_authenticated_header = yes
##
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
########## DOBAVIL #########
smtpd_client_restrictions=
        permit_sasl_authenticated,
        permit_mynetworks,
        reject_unknown_client_hostname,
        reject_unauth_destination,
        reject_unauth_pipelining,
###     reject_rbl_client zen.spamhaus.org,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client cbl.abuseat.org,
        permit
#Не общаться с почтовыми системами, которые не знают имени своего хоста
smtpd_helo_restrictions = permit_sasl_authenticated, 
        permit_mynetworks,
        reject_unknown_hostname,
        reject_invalid_hostname,
        reject_non_fqdn_hostname,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain
smtpd_sender_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
        reject_unknown_sender_domain,
        reject_non_fqdn_sender
smtpd_recipient_restrictions =
        reject_invalid_hostname,
        reject_unknown_recipient_domain,
        reject_unauth_pipelining,
        reject_non_fqdn_helo_hostname,
        reject_unknown_helo_hostname,
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_sender_domain,
        reject_unlisted_recipient,
        reject_unverified_recipient,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
        reject_rbl_client multi.uribl.com,
        reject_rbl_client dsn.rfc-ignorant.org,
        reject_rbl_client dul.dnsbl.sorbs.net,
        reject_rbl_client list.dsbl.org,
        reject_rbl_client sbl-xbl.spamhaus.org,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client dnsbl.sorbs.net,
        reject_rbl_client cbl.abuseat.org,
        reject_rbl_client ix.dnsbl.manitu.net,
        reject_rbl_client combined.rbl.msrbl.net,
        reject_rbl_client rabl.nuclearelephant.com,
        check_policy_service inet:127.0.0.1:10030,
#       check_policy_service unix:/var/spool/postfix/postgrey/socket,
        check_client_access hash:$config_directory/access_client,
        check_sender_access hash:$config_directory/access_sender,
        permit
smtpd_data_restrictions =
        reject_unauth_pipelining
#smtpd_restriction_classes = OnlyFromMyUsers
#OnlyFromMyUsers = permit_mynetworks,
#                  permit_sasl_authenticated,
#                  reject 
#
################ DKIM ################
smtpd_milters = unix:/var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/var/run/opendkim/opendkim.sock
#smtpd_milters           = inet:127.0.0.1:8891  
#non_smtpd_milters       = $smtpd_milters  
milter_default_action   = accept  
#milter_protocol         = 2
####################################
sample_directory = /etc/postfix
#smtp_pix_workaround_delay_time = 10s
#smtp_pix_workaround_maps = hash:$config_directory/pix_workarounds
#smtp_pix_workaround_threshold_time = 500s
smtp_pix_workarounds = disable_esmtp,delay_dotcrlf
#smtp_pix_workaround_maps = 
# TLS/SSL options
smtpd_use_tls = yes
####
##smtpd_tls_security_level = may
##smtpd_tls_ciphers = export
##smtp_tls_protocols = !SSLv2, !SSLv3
##smtpd_tls_loglevel = 1
###
#smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/letsencrypt/live/mail.gb2bel.ru/privkey.pem
#smtpd_tls_cert_file = /etc/letsencrypt/live/mail.gb2bel.ru/cert.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.gb2bel.ru/fullchain.pem
smtpd_tls_CAfile = /etc/letsencrypt/live/mail.gb2bel.ru/chain.pem
##smtpd_tls_key_file = /etc/postfix/ssl/201211-mail.gb2bel.ru/mail.gb2bel.ru.key
##smtpd_tls_cert_file = /etc/postfix/ssl/201211-mail.gb2bel.ru/mail.gb2bel.ru.crt
##smtpd_tls_CAfile = /etc/postfix/ssl/201211-mail.gb2bel.ru/ca.crt
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
content_filter = scan:127.0.0.1:8025
##content_filter = scan:127.0.0.1:10025 
receive_override_options = no_address_mappings
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc 
#smtpd_milters = local:/var/run/milter/spamass-milter.sock inet:127.0.0.1:3001
#smtpd_milters = inet:127.0.0.1:3001
#milter_content_timeout = 300s
#milter_default_action = tempfail
#milter_protocol = 6
#milter_mail_macros = _
#milter_mail_macros = {client_addr}
#milter_mail_macros = {client_name} 
#milter_end_of_data_macros = i auth_type
######################################
### ADDED BY MAILD-POSTFIX INSTALL ###
######################################
#content_filter = spamassassin
#receive_override_options = no_address_mappings
compatibility_level = 2
smtp_tls_session_cache_database = btree:/var/db/postfix/smtp_scache
smtp_tls_security_level = may
smtp_tls_loglevel = 1
header_checks = regexp:/etc/postfix/header_checks
body_checks = regexp:/etc/postfix/body_checks
#smtp_header_checks = pcre:/etc/postfix/smtp_header_checks
smtputf8_enable = no