Good idea, instead of writing to tmpfile I'm using syslog and here's what I got:
May 31 14:47:25 host01 dovecot: report-spam.sh: id=uid=110(popuser) gid=31(popuser) groups=31(popuser),97(dovecot) env=HOST=plesk
[email protected] PWD=/mnt/xvda3/qmail/mailnames/domain.com/spamcop_spam...