MisterWebNet

CSF - Config Server and Firewall monitors the system for login/intrusions and notifies the root account of suspicious activity. In this case, our inbox was full of emails in the form;

Suspicious process running under user dovecot:

Executable:
/usr/libexec/dovecot/imap-login

Command Line (often faked in exploits):

imap-login

The emails might also be of the form;

Executable:

/usr/libexec/dovecot/pop3-login

If you no longer wish to receive these emails, you need to edit the file csf.pignore. This file lists the processes you wish to ignore.

Solution? Insert these lines into your csf.pignore file;

exe:/usr/libexec/dovecot/imap
exe:/usr/libexec/dovecot/pop3
exe:/usr/libexec/dovecot/pop3-login