You can keep getting theese mails, even though the dashboard says that data and log disk are only used a few percent.
(You need to get shell access to the UTM to continue)
There can be many reasons for this, but a common one is the log file for the database running in the UTM, which is located here:
/var/storage/pgsql92/data
Here you can run the following as root:
/etc/init.d/postgresql92 rebuild
This will rebuild and clear out any large logfiles from the database.
Beware: This is not a supported fix and you may loose logging information for history purposes.
HTH 🙂
I have written further solutions in an article. This is in german but you could extend your contribution.
https://www.sult.eu/2018/09/26/sophos-utm-root-partition-is-filling-up-please-check/