The logging facility of the Debian smtp-refuser package allows local users to delete arbitrary files using symbolic links.
debian debian linux 4.0