diff --git a/modoboa/core/models.py b/modoboa/core/models.py
index 57faece90..66805169e 100644
--- a/modoboa/core/models.py
+++ b/modoboa/core/models.py
@@ -88,6 +88,7 @@ class User(PermissionsMixin):
         for ooentry in self.objectaccess_set.filter(is_owner=True):
             if ooentry.content_object is not None:
                 grant_access_to_object(owner, ooentry.content_object, True)
+                ungrant_access_to_object(ooentry.content_object, self)
 
         events.raiseEvent("AccountDeleted", self, fromuser, **kwargs)
         ungrant_access_to_object(self)
diff --git a/modoboa/extensions/admin/tests/alias.py b/modoboa/extensions/admin/tests/alias.py
index 69702f50c..e2ad06dac 100644
--- a/modoboa/extensions/admin/tests/alias.py
+++ b/modoboa/extensions/admin/tests/alias.py
@@ -48,15 +48,19 @@ class AliasTestCase(ModoTestCase):
         )
         self.assertEqual(user.mailbox_set.first().alias_set.count(), 1)
         self.assertEqual(
-            user.mailbox_set.first().alias_set.first(), "toto@test.com")
+            user.mailbox_set.first().alias_set.first().full_address,
+            "toto@test.com"
+        )
 
         values = {
-            "email": "Titi@test.com", "recipient": "user@test.com",
+            "email": "Titi@test.com", "recipients": "user@test.com",
             "enabled": True
         }
         self.ajax_post(reverse("admin:alias_add"), values)
         self.assertEqual(
-            user.mailbox_set.first().alias_set.first(), "titi@test.com")
+            user.mailbox_set.first().alias_set.first().full_address,
+            "titi@test.com"
+        )
 
     def test_dlist(self):
         values = dict(email="all@test.com",
diff --git a/modoboa/extensions/admin/tests/domain_alias.py b/modoboa/extensions/admin/tests/domain_alias.py
index a13abc915..c4a1e5538 100644
--- a/modoboa/extensions/admin/tests/domain_alias.py
+++ b/modoboa/extensions/admin/tests/domain_alias.py
@@ -19,6 +19,7 @@ class DomainAliasTestCase(ModoTestCase):
         domal = DomainAlias()
         domal.name = "domalias.net"
         domal.target = dom
+        domal.enabled = True
         domal.save()
         self.assertEqual(dom.domainalias_count, 1)
 
diff --git a/modoboa/extensions/limits/tests.py b/modoboa/extensions/limits/tests.py
index f13477bc6..7a9f0927e 100644
--- a/modoboa/extensions/limits/tests.py
+++ b/modoboa/extensions/limits/tests.py
@@ -39,6 +39,27 @@ class PermissionsTestCase(ExtTestCase):
         self.assertEqual(resp, "Permission denied")
 
 
+    def test_delete_forward(self):
+        """Delete a forward created by a user.
+
+        This test was added to help fixing #689.
+        """
+        self.clt.logout()
+        self.clt.login(username="user@test2.com", password="toto")
+
+        values = {
+            "dest": "rcpt@dest.com",
+            "keepcopies": True
+        }
+        self.ajax_post(reverse("user_forward"), values)
+
+        user = User.objects.get(username="user@test2.com")
+
+        self.clt.logout()
+        self.clt.login(username="admin", password="password")
+        self.ajax_post(reverse("admin:account_delete", args=[user.pk]))
+
+
 class ResourceTestCase(ExtTestCase):
     fixtures = ["initial_users.json"]
 
diff --git a/modoboa/lib/permissions.py b/modoboa/lib/permissions.py
index a4b3487d3..abca0a6b8 100644
--- a/modoboa/lib/permissions.py
+++ b/modoboa/lib/permissions.py
@@ -45,22 +45,15 @@ def grant_access_to_object(user, obj, is_owner=False):
     :param obj: an admin. object (Domain, Mailbox, ...)
     :param is_owner: the user is the unique object's owner
     """
-    ct = ContentType.objects.get_for_model(obj)
-    try:
-        entry = user.objectaccess_set.get(content_type=ct, object_id=obj.id)
-        entry.is_owner = is_owner
-        entry.save()
-    except ObjectAccess.DoesNotExist:
-        pass
-    else:
-        return
-
-    ObjectAccess.objects.create(
-        user=user, content_type=ct, object_id=obj.id, is_owner=is_owner
-    )
-    if not is_owner:
-        return
     from modoboa.core.models import User
+
+    ct = ContentType.objects.get_for_model(obj)
+    entry, created = ObjectAccess.objects.get_or_create(
+        user=user, content_type=ct, object_id=obj.id)
+    entry.is_owner = is_owner
+    entry.save()
+    if not created or not is_owner:
+        return
     for su in User.objects.filter(is_superuser=True):
         if su == user:
             continue
@@ -80,10 +73,8 @@ def grant_access_to_objects(user, objects, ct):
     :param ct: the content type
     """
     for obj in objects:
-        try:
-            ObjectAccess.objects.create(user=user, content_type=ct, object_id=obj.id)
-        except IntegrityError:
-            pass
+        ObjectAccess.objects.get_or_create(
+            user=user, content_type=ct, object_id=obj.id)
 
 
 def ungrant_access_to_object(obj, user=None):