Ah, got it. bayes_journal is just a temp file before synchronized into the databases. The server where I see it, is very low volume, so it takes some time until bayes_journal_max_size is reached. I thought it's a mimedefang permission problem.