Noticed in info-en-c, other queues reporting it as well
A quick eyeball at the emails show it's a pretty standard "spoofing our email as a from address and reply-to address" spam. This happens about once every six months to a year but this is by far the biggest I've seen.
It's not only info-en-c, other queues are receiving this as well. Many messages get immediately stuck in the probably spam queue, others are being manually moved from other queues into that one, apparently (no idea why, people should be moving them directly to junk instead of contributing to the flood)
The email storm can be witnessed at https://grafana.wikimedia.org/d/000000451/mail?orgId=1&from=1548346803405&to=1548357438520&var-datasource=codfw%20prometheus%2Fops (this is the secondary DC) and https://grafana.wikimedia.org/d/000000451/mail?orgId=1&from=1548346740714&to=1548358041101&var-datasource=eqiad%20prometheus%2Fops (for the primary DC). The 2 distinct phases are there because of me freezing a ton of emails which later got thawed and eventually delivered.
It seems under control to me. There are spam emails from different sources in "Probably-spam", which is normal, and they have to be moved to "Junk" if they are really spam mails.
There are few emails from MAILER-DAEMON@smtp-sortant10.phpnet.org and I am setting up a new filter for it, just in case. Thanks
Graphs in codfw mail and eqiad mail point out that this behavior has not reemerged since Jan 25, so I 'll tentatively close this as resolved. Feel free to reopen