In most cases this happened if the SMTP Proxy is active and configured as spam filter. In some circumstances, for example after certain types of mail bomb/floods the antispam daemon may fill up it's temporary directories with extracted mail contents or with quarantine files

In order to check if this happened, do the following in the a shell of your firewall:

du /var -hc --max-depth=4 | sort -rn | head -10

This shows you the directories with most content ordered by content size.

If you find amavis directories with a very high amount of content, you can remove old already processed files with the following commands:

rm -rf /var/amavis/virusmails/*
rm -rf /var/amavis/amavis-*
rm -rf /var/tmp/clamav-*

After this you can restart the smtp proxy by calling the following commands:

restartsmtpscan

and force the smtp proxy to process it's mail queue

postqueue -f