The postfix decoder is matching wrong, e.g.:
Jul 04 16:04:01 somehost postfix/postdrop[891725]: warning: mail_queue_enter: create file maildrop/386940.891725: No space left on device
and classifies it as "Postfix: Illegal address from unknown sender". That's obviously wrong.
That prevents to collect this event under rule 1007 "File system full."