*) Please show us related log.
*) Postfix doesn't store message in SQL database, i guess you misunderstood some log.

Postfix doesn't store e-mails. It delivers them, either to the remote server, or locally to dovecot. Dovecot then stores them in the mailboxes, by default /var/vmail/vmail/[domain]/[several subfolders]

I have no valid reason to believe that iredmail stores messages in database. I thought that it do because mysql was configured during installation and I really don't know for which particular purpose. Maybe database has good effectivity for text data indexing, fulltext search or so. As 7t3chguy explained above dovecot stores messages in filesystem.

According to logs: I have only logfiles noted at the beginnig of first message. Server had not installed standard syslog daemon at the time of incident, so I have no /var/log/mail.log records from this time. Yes, I installed it immediately, but for forensic purposes - too late.

According to configuration fragment below, I think that quarrateeing was not enabled.
---
# Don't quarantine mails with bad header.
$bad_header_quarantine_method = undef;

# Quarantine SPAM.
# Where to store quarantined mail message:
#   - 'local:spam-%i-%m', quarantine mail on local file system.
#   - 'sql:', quarantine mail in SQL server specified in @storage_sql_dsn.
#   - undef, do not quarantine mail.
$spam_quarantine_method = undef;
#$spam_quarantine_method = 'sql:';
#$spam_quarantine_to = 'spam-quarantine';

#########################
# Quarantine VIRUS mails.
#
#$virus_quarantine_to     = 'virus-quarantine';
#$virus_quarantine_method = 'sql:';

#########################
# Quarantine BANNED mails.
#
$banned_files_quarantine_method = undef;
# Or quarantine banned mail to SQL server.
#$banned_files_quarantine_method = 'sql:';
#$banned_quarantine_to = 'banned-quarantine';

#########################
# Quarantine CLEAN mails.
# Don't forget to enable clean quarantine in policy bank 'MYUSERS'.
#
# = 'sql:';
# = 'clean-quarantine';
---