If you using a cron job to import tickets from email, it sounds like the message from the banned email address isn't getting marked read/deleted and the cron job is attempting to import it over and over.
I know it's been a while, but I am investigating it again, I think you are right. Each time the cron job runs I get a show a bunch of "ticket denied" messages in the log.
Up until now, we have just unbanned all e-mails and dealt with the spam to work around the issue.
Now to address this, it seems I will need a way of marking the e-mail as read or deleted so that my mail server stops offering them when the cron job runs. That, or tell the mail server to stop sending the message after several days.
If I had the choice, I would rather make changes to osTicket as a failure would only affect a few of us.
Anyone have thoughts on it? Maybe some hack to forward e-mails from banned addresses to somewhere else. Thanks in advance.