Hi,
I'm bumping this thread because, in addition to the copy and redirect roundcube filters discussed here, I've come across another roundcube hack symptom: creating a new "fake" identity.
To check this you must log to the plesk db:
plesk db;
use roundcubemail;
select user_id, changed...