Jan 29 16:33:22 mail postfix/pickup[1960]: 312676037EE39: uid=33 from=<www-data>
Jan 29 16:33:22 mail postfix/cleanup[64497]: 312676037EE39: message-id=<20170129203322.312676037EE39@mail.mydomain.com>
Jan 29 16:33:22 mail postfix/qmgr[60188]: 312676037EE39: from=<www-data@mail.mydomain.com>, size=783, nrcpt=1 (queue active)
Jan 29 16:33:22 mail dovecot: imap-login: Login: user=<validuser>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=2213, secured, session=<MjoQnEFH3AB/AAAB>
Jan 29 16:33:22 mail dovecot: imap(validuser): Disconnected: Logged out in=93 out=837
Jan 29 16:33:22 mail postfix/pickup[1960]: 4DBEB6037EE3A: uid=33 from=<www-data>
Jan 29 16:33:22 mail postfix/cleanup[61997]: 4DBEB6037EE3A: message-id=<20170129203322.4DBEB6037EE3A@mail.mydomain.com>
Jan 29 16:33:22 mail postfix/qmgr[60188]: 4DBEB6037EE3A: from=<www-data@mail.mydomain.com>, size=844, nrcpt=1 (queue active)

Linux Malware Detect v1.5
            (C) 2002-2016, R-fx Networks <proj@rfxn.com>
            (C) 2016, Ryan MacDonald <ryan@rfxn.com>
This program may be freely redistributed under the terms of the GNU GPL v2

maldet(13019): {mon} existing inotify process detected (try -k): 53745

mail.add_x_header = On
mail.log = /var/log/phpmail.log

chgrp -R www-data /var/log/phpmail.log
chown -R www-data /var/log/phpmail.log