Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Exchange 2003 server that sent me an email this morning:

SMTP Server Remote Queue Length Alert

Looking in the queues using Exchange System Manager there were just over 16,000 spam emails waiting to be sent out. We send via an external filtering service which was disconnecting our server, presumably due to the level of outgoing spam.

How can I find out where this mail is coming from? Does Exchange 2003 log IP addresses etc somewhere?

share|improve this question

You're probably an open relay. First thing's first is to lock down your setup. Here's some directions:

share|improve this answer
+1 - unlikely some internal user was try ing that (even a trojan). Most likely an open relay. – TomTom Aug 22 '10 at 22:20

Tracking down the source of outgoing spam in Exchange Server 2003 can be difficult. One thing you can try (assuming that you've got message tracking enabled) is to open one of the remote queues and look at the recipient address then track that address in the Message Tracking tool in ESM. That may allow you to find the originator of the spam. I would also recommend using the aqadmcli utility to clear out your queues.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.