i took it to the postfix mailing lists now
hi all, there is a workaround in place for now, which is disabling .fordward completely by setting an empty forward_path. the cause of the problem seems to be a non-POSIX behaviour of glibcs getpwnam_r() function. a more lengthy discussion can be found here . i am not aware of any changes to glibc (2.24-2 from core installed here since august), but maybe someone has a hint what caused this behaviour to change?
now that a workaround is in place this becomes less urgent though, still it would be nice to understand what actually happened.