This was caused by a looping email. The email forward was a procmail rule on one of the users. The forward address was inactive causing continuous bounce messages back to the account on the sme.
Once I cleaned up the bounce mess, clamav has been behaving.