Thanks. Now we have proof.
This is a snippet of the /var/log/qpsmtpd/current log. In here the is a line that says it converted the attachment. Very strange. I have no idea what to do.
2007-02-13 08:59:16.333833500 26280 dispatching MAIL FROM: <rostons@3blokes.com>
2007-02-13 08:59:16.335009500 26280 full from_parameter: FROM: <rostons@3blokes.com>
2007-02-13 08:59:16.335473500 26280 from email address : [<rostons@3blokes.com>]
2007-02-13 08:59:16.337917500 26280 running plugin (mail): require_resolvable_fromhost
2007-02-13 08:59:16.338919500 26280 trying to get config for invalid_resolvable_fromhost
2007-02-13 08:59:16.342969500 26280 trying to get config for require_resolvable_fromhost
2007-02-13 08:59:16.344285500 26280 Plugin require_resolvable_fromhost, hook mail returned DECLINED,
2007-02-13 08:59:16.344783500 26280 running plugin (mail): rhsbl
2007-02-13 08:59:16.346787500 26280 trying to get config for rhsbl_zones
2007-02-13 08:59:16.348280500 26280 rhsbl plugin: Checking 3blokes.com.dsn.rfc-ignorant.org for TXT record in the background
2007-02-13 08:59:16.356658500 26280 Plugin rhsbl, hook mail returned DECLINED,
2007-02-13 08:59:16.357311500 26280 running plugin (mail): check_badmailfrom
2007-02-13 08:59:16.358148500 26280 trying to get config for badmailfrom
2007-02-13 08:59:16.359435500 26280 Plugin check_badmailfrom, hook mail returned DECLINED,
2007-02-13 08:59:16.360125500 26280 getting mail from <rostons@3blokes.com>
2007-02-13 08:59:16.360690500 26280 250 <rostons@3blokes.com>, sender OK - how exciting to get mail from you!
2007-02-13 08:59:17.186711500 26280 dispatching RCPT TO: <madeleine@ezecab.co.za>
2007-02-13 08:59:17.187691500 26280 to email address : [<madeleine@ezecab.co.za>]
2007-02-13 08:59:17.188725500 26280 running plugin (rcpt): rhsbl
2007-02-13 08:59:17.189880500 26280 rhsbl plugin: waiting for rhsbl dns
2007-02-13 08:59:17.190666500 26280 rhsbl plugin: DONE waiting for rhsbl dns, got 1 answers ...
2007-02-13 08:59:17.194457500 26280 Plugin rhsbl, hook rcpt returned DECLINED,
2007-02-13 08:59:17.194961500 26280 running plugin (rcpt): dnsbl
2007-02-13 08:59:17.195842500 26280 trying to get config for dnsbl_zones
2007-02-13 08:59:17.198122500 26280 Plugin dnsbl, hook rcpt returned DECLINED,
2007-02-13 08:59:17.198636500 26280 running plugin (rcpt): check_badmailfrom
2007-02-13 08:59:17.199372500 26280 Plugin check_badmailfrom, hook rcpt returned DECLINED,
2007-02-13 08:59:17.199911500 26280 running plugin (rcpt): check_badrcptto_patterns
2007-02-13 08:59:17.200783500 26280 Plugin check_badrcptto_patterns, hook rcpt returned DECLINED,
2007-02-13 08:59:17.201302500 26280 running plugin (rcpt): check_badrcptto
2007-02-13 08:59:17.202100500 26280 Plugin check_badrcptto, hook rcpt returned DECLINED,
2007-02-13 08:59:17.202646500 26280 running plugin (rcpt): check_goodrcptto
2007-02-13 08:59:17.203588500 26280 Plugin check_goodrcptto, hook rcpt returned DECLINED,
2007-02-13 08:59:17.204070500 26280 running plugin (rcpt): rcpt_ok
2007-02-13 08:59:17.204815500 26280 trying to get config for me
2007-02-13 08:59:17.205348500 26280 trying to get config for rcpthosts
2007-02-13 08:59:17.207153500 26280 trying to get config for morercpthosts
2007-02-13 08:59:17.208093500 26280 Plugin rcpt_ok, hook rcpt returned OK,
2007-02-13 08:59:17.208749500 26280 250 <madeleine@ezecab.co.za>, recipient ok
2007-02-13 08:59:17.500024500 26280 dispatching DATA
2007-02-13 08:59:17.501062500 26280 354 go ahead
2007-02-13 08:59:17.501779500 26280 trying to get config for databytes
2007-02-13 08:59:17.502283500 26280 max_size: 15000000 / size: 0
2007-02-13 08:59:17.503399500 26280 trying to get config for timeout
2007-02-13 08:59:17.517186500 26280 spooling message to disk
2007-02-13 08:59:17.619925500 26280 max_size: 15000000 / size: 71443
2007-02-13 08:59:17.620740500 26280 trying to get config for me
2007-02-13 08:59:17.622523500 26280 running plugin (data_post): check_basicheaders
2007-02-13 08:59:17.623940500 26280 Plugin check_basicheaders, hook data_post returned DECLINED,
2007-02-13 08:59:17.624484500 26280 running plugin (data_post): virus::pattern_filter
2007-02-13 08:59:17.625283500 26280 trying to get config for pattern_filter
2007-02-13 08:59:17.626161500 26280 trying to get config for signatures_patterns
2007-02-13 08:59:17.675708500 26280 Plugin virus::pattern_filter, hook data_post returned DECLINED,
2007-02-13 08:59:17.676259500 26280 running plugin (data_post): tnef2mime
2007-02-13 08:59:17.819768500 26280 tnef2mime plugin: converted attachment #1: Statemen.pdf (application/pdf, 49920 bytes)
2007-02-13 08:59:17.879894500 26280 Plugin tnef2mime, hook data_post returned DECLINED,
2007-02-13 08:59:17.880452500 26280 running plugin (data_post): spamassassin
2007-02-13 08:59:17.881268500 26280 spamassassin plugin: check_spam
2007-02-13 08:59:17.887558500 26280 spamassassin plugin: check_spam: connected to spamd
2007-02-13 08:59:17.969191500 26280 spamassassin plugin: check_spam: finished sending to spamd
2007-02-13 08:59:27.485756500 26280 spamassassin plugin: check_spam: spamd: SPAMD/1.1 0 EX_OK
2007-02-13 08:59:27.485766500
2007-02-13 08:59:27.485769500 26280 trying to get config for me
2007-02-13 08:59:27.488154500 26280 spamassassin plugin: check_spam: spamd: Content-length: 0
2007-02-13 08:59:27.488163500
2007-02-13 08:59:27.488166500 26280 spamassassin plugin: check_spam: spamd: Spam: False ; 0.0 / 4.0
2007-02-13 08:59:27.488171500
2007-02-13 08:59:27.488175500 26280 spamassassin plugin: check_spam: spamd:
2007-02-13 08:59:27.488179500
2007-02-13 08:59:27.497487500 Use of uninitialized value in substitution (s///) at /usr/share/qpsmtpd/plugins/spamassassin line 189, <SPAMD> line 4.
2007-02-13 08:59:27.497498500 26280 spamassassin plugin: check_spam: finished reading from spamd
2007-02-13 08:59:27.497503500 Use of uninitialized value in concatenation (.) or string at /usr/share/qpsmtpd/plugins/spamassassin line 213, <SPAMD> line 4.
2007-02-13 08:59:27.497510500 Use of uninitialized value in concatenation (.) or string at /usr/share/qpsmtpd/plugins/spamassassin line 216, <SPAMD> line 4.
2007-02-13 08:59:27.497575500 26280 spamassassin plugin: check_spam: No, hits=0.0, required=4.0, tests=
2007-02-13 08:59:27.497581500 26280 Plugin spamassassin, hook data_post returned DECLINED,
2007-02-13 08:59:27.506609500 26280 running plugin (data_post): spamassassin
2007-02-13 08:59:27.506621500 26280 spamassassin plugin: check_spam_reject: reject_threshold=7
2007-02-13 08:59:27.506627500 26280 spamassassin plugin: check_spam_reject: score=0.0
2007-02-13 08:59:27.506632500 26280 spamassassin plugin: check_spam_reject: passed
2007-02-13 08:59:27.506638500 26280 Plugin spamassassin, hook data_post returned DECLINED,
2007-02-13 08:59:27.506643500 26280 running plugin (data_post): spamassassin
2007-02-13 08:59:27.506648500 26280 Plugin spamassassin, hook data_post returned DECLINED,
2007-02-13 08:59:27.506745500 26280 running plugin (data_post): virus::clamav
2007-02-13 08:59:27.506750500 26280 virus::clamav plugin: Changing permissions on file to permit scanner access
2007-02-13 08:59:27.506756500 26280 virus::clamav plugin: Running: /usr/bin/clamdscan --stdout --disable-summary /var/spool/qpsmtpd/1171349957:26280:0 2>&1
2007-02-13 08:59:27.681021500 26280 virus::clamav plugin: clamscan results: /var/spool/qpsmtpd/1171349957:26280:0: OK
2007-02-13 08:59:27.681859500 26280 Plugin virus::clamav, hook data_post returned DECLINED,
2007-02-13 08:59:27.682616500 26280 running plugin (queue): queue::qmail_2dqueue
2007-02-13 08:59:27.689809500 26284 queue::qmail_2dqueue plugin: (for 26280 ) Queuing qp 26284 to /var/qmail/bin/qmail-queue
2007-02-13 08:59:27.903701500 26280 Plugin queue::qmail_2dqueue, hook queue returned OK, Queued! 1171349967 qp 26284 <>
2007-02-13 08:59:27.903712500 26280 250 Queued! 1171349967 qp 26284 <>
2007-02-13 08:59:30.413196500 26280 dispatching QUIT
2007-02-13 08:59:30.413205500 26280 trying to get config for me
2007-02-13 08:59:30.413209500 26280 221 3blokes.net closing connection. Have a wonderful day.
2007-02-13 08:59:30.413214500 26280 click, disconnecting