On cPanel servers user forwarders and autoresponders are located in the /etc/valiases/ directory and separate for each domain (Forwarders and autoresponders for all email addresses under domain example.net are located in the /etc/valiases/example.net file).
Here is an example file:
cat /etc/valiases/example.net

In our example:
– the first line is a forwarder from one email address to another
– the second line is a forwarder from stefan@example.com to a file (PHP script) and an autoresponder for the same address
– the last line is the default action for unrouted emails. In this case, the “No such person at this address.” message will be sent back.
You can also check forwarders/autoresponders by accessing the user’s cPanel account.
For individual email filters check this guide: Where are individual email filter files on a cPanel server