Ok - i found the typo - it was in our own imp/config/prefs.php . we 
omited the underscore there.



So you can clear this ticket

Horde Version is 3.3.4:



If we are trying to forward a mail and not using the dropdown menue of 
the forward icon but using the default action it yields this error 
message:



We cannot verify that this request was really sent by you. It could be 
a malicious request. If you intended to perform this action, you can 
retry it now.



If we retry it works but seemingly not in every case for every user. 
our customers are a little confused here.



The only difference i can see in the below javascript row be choosing 
the default action  is :



javascript:pop_imp('/horde/imp/compose.php',700,650,'actionID=forwardall&index=140147&identity=2&thismailbox=INBOX);



but choosing the action from the dropdown menu manualy:



javascript:pop_imp('/horde/imp/compose.php',700,650,'actionID=forward_all&index=140147&identity=2&thismailbox=INBOX);



the difference is 'forwardall' but not 'forward_all' . Maybe a typo ?