Have you opened up Apple Mail on one of the clients and performed a mailbox rebuild?
(Mailbox --> Rebuild)
If the message still does not appear, perhaps the spam scanner on the server caught it and removed it? What do your rules look like for that? Have you done any modifications to spamassassin? Are there any server-side rules on the mailbox?
- We did rebuild the mailbox.
- No modifications to spamassissin.
- No local or server side rules.
Your response raises a question: What is the flow of an email message through OS X Server? Does clamav and spamassassin run before or after an email is placed in the inbox? I ask because the message I saw disappear was in the inbox for a short period of time.
It runs before the message hits the inbox. But it makes me wonder if there is either a server-side rule or a .forward in the home directory of the user. Also check the postfix main.cf to see if there's anything unusual in there. You may try raising the log level of your server's mail operations and watching it.
There is one other possibility, but this one will be harder to track down. It could be that someone has a client (iPhone or other computer at home) set up as a POP3 client instead of IMAP. POP3 configurations often "pop" an email off the server and download it to the local cache, then delete the server side copy. IMAP clients will see the email, then it will disappear in the method that you describe.
To troubleshoot, turn off POP access or block port 110 on the firewall, then see who complains about their client getting an error message. Check the configuration. If it's set to POP access, it is likely misconfigured and removing the email from the server.
As a permanent solution, disable POP3 access to mailboxes if this is acceptable to the company.