Hi all. For the third time (once many years ago, then again two months ago, and now today) a single user account has taken down my SM server. 

The first occurrence, years ago, I was told that it was corrupted indexes due to an old version of Outlook. I had to pay for emergency help and then had to move everything to a whole new physical server. Three weeks of crashing.

Two months ago it happened again. This time it was an account that received several very large video attachments, none of which should have been accepted by SM because I have the SMTP-In message limit set to 30 MB. The user tried to delete them, and what ensued was a repeating whack-a-mole of using the webmail interface to delete the emails, waiting a second, clicking into another folder, then clicking back to Deleted Items and seeing them there again, totaling over 400 GB. Apparently that was because the account was using Outlook, but not too old. Deleted emails kept reappearing. That was another three weeks of my life.

This morning my server crashed again when again when a user received a 500 MB video attachment. Again, how did that email make it through the 30MB limit barrier? This time the customer was using MacMail and deleted that single email. Ugh. Had she been in the office she would have used the webmail interface. From that point on, if I go into the Deleted Items folder to delete everything there, the big 500MB email reappears, repeated over and over dozens of times, consuming my entire hard drive. Crash!

Once restarted, the server will only stay up for about five or ten minutes. I cannot delete the offending emails without them doing the Sorcerer's Apprentice broom thing and filling the hard drive again.

Has this happened to anyone else out there, and what did you do to stop this behavior from happening? Will disabling the account stop the indexing?

I'm working with support but haven't heard back from them in over two hours. My server is still down, and I'm pretty much at my wit's end. 

I don't want to pay for an emergency ticket because I feel that this is not my fault. I am astonished that something wasn't done to prevent this runaway rogue indexing process from taking down an entire email server because of ONE account. Shouldn't there be a watcher process that kills any activity like this? Maybe a quick JSON file format checker or something that can see when something is not right?