What version are you running in this environment? Are you able to see anything else touching those GRP files in Process Monitor (from Microsoft) or might they have failed forwarding?

Hi Kyle, me again, sorry.

Build 8025

They should be forwarding to another address on the same server, just a different domain.

If I do a test, it does forward and delete.

The last one was on 5th Jan 2022, so I am assuming in general it seems to be forwarding and deleting, but not for all messages.

There are a few messages in the old account that should have been forwarded and deleted but they aren't in the new account.

Hey there! Not to worry at all! I do suggest submitting a ticket on this one so we can take a closer look as that doesn't sound like its working as expected. 

OK, so I have an email that hasn't been forwarded and deleted in that mailbox this morning, so there's definitely something not quite right.

Are there any logs I can set to detailed or anything in the server logs to look for that may show an issue?

Your best bet would be checking out the Delivery logs to see what it says it did with it. It should say Forwarded Deleted in the final delivery log line. Do you see that? If so, this might point towards something locking the email preventing us deleting it when finished forwarding. 

This is all I have in the log at that time related to the email that didn't get forwarded:

The email was from PayPal@mail.paypal.co.uk and this is the only thing I can see related to it at that time.

So it looks like it bounced for some reason?

[2022.01.19] 00:39:56.449 [82332749] Delivery started for bounce@mail.paypal.co.uk at 12:39:56 AM

[2022.01.19] 00:40:08.450 [82332749] Delivery finished for bounce@mail.paypal.co.uk at 12:40:08 AM    [id:x82332749]

That might be the message we're looking for, as they're probably specifying their MAIL FROM as the bounce@ address in case it fails delivery, that way the return messages go to their catch-all. Can you try searching the Delivery log for  [82332749] and let me know what the full session looks like? You can DM this to me if you'd prefer. 

I went ahead and created a ticket for you on this as we were not able to reproduce these issues in-house. I'll follow-up here again once we get to the bottom of it in case anyone else is having those issues as well.