Ehlo,
For a long time I wanted to get notified if an email I send or receive was deleted by clamsmtp without searching through logs.
Valid also if an email for/from another user hosted on the server gets falsely flagged as malware by clamav and deleted, which happens from time to time.
My setup deletes the email if clamav finds malware.
I wrote a script that gets called by clamsmtp and notifies the recipient and/or sender ONLY if the recipient and/or sender are hosted on the same server running the script.
For Virtualmin, the best place (in my mind) to determine if a domain using email services is hosted with a server is by querying /etc/dkim-domains.txt
If you are not signing with DKIM, maybe try virtualmin list-domains --name-only --with-feature mail
If you also need this feature, take a look at GitHub - Deepcuts/clamsmtp-notifier: clamsmtp-notifier
Any improvements or suggestions are welcome.
I am sure there are other ways, but this is what I got used to.
Hope it helps someone.