When setting the CC field to an address ending on an MS Exchange Server, Exchange silently drops the warning mails that it considers "duplicate".
For example when multiple users are over quota, the /etc/webmin/quota/email.pl script is launched.
It computes quotas and then calls mailboxes::send_text_mail, which in turn calls send_mail in boxes-lib.pl.
This is where the bug resides. The message-id is not randomized enough (timestamp + process id).
In many cases, with actual computers, the timestamp has not the time to increment between the calls and the process id remains the same (I don't know why, I did not investigate).
This leads to many duplicate message-ids in the mails sent from this module.
I bet it the same with all the modules calling boxes-lib.
Attached is a patch that adds a random number between the timestamp and the process id.
It should be random enough.