In cPanel under an email account you can Free up Email Storage. There is a Custom query field which allows you to specify a custom Dovecot query to run. Couple examples below.

Delete email from email address

from sent@email.com

Email that contains a specific string in the message body

body "string to match in message body"

Other useful info
https://wiki2.dovecot.org/Tools/Doveadm/SearchQuery