Suspect, mails are banned due to attachent only for single user.

[Damian]

> The file structre is that what debian is using. We have adoped the
> settings to meet the local domains and also changeg av-scanners to
> include sophos.

This does not yet answer my question. You say that you have made
changes, but if the basis of your changes is not clear, then the current
state is not clear either. Have you or your colleagues (who you can
still ask about it) built this mail setup yourselves from scratch, or
are you adapting a mail setup that a third party built?

I am asking this because in the latter case, there are still
possibilities to introduce different behavior apart from /etc/amavis/conf.d:

- Modifying or adding files to /usr/share/amavis/conf.d
- Using a different entry config file via a modified initscript
- Using a different entry config file via a custom systemd unit
- Using an executable from a different path
- Using an amavis package that is not the one provided by Debian 9
- Modifying the amavis executable

With log level 2 or higher, you should see a startup message stating
> config files read: /usr/share/amavis/conf.d/10-debian_scripts, ...

Do you see unexpected config files there?

If you can reproduce the issue yourself, you might run amavis with log
level 5, which should give more insight on the issue.