Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my users received a spam message from his internal exchange server on an SBS 2003 machine. The message apparently orginated from an unknown user from his own domain. (i.e. received a spam message from However, does not exist and there is no mailbox for him. I checked and there are no open relays. What do I need to do to figure out how this happened and how to stop it? The message did show up in the message tracking center. With the following info:
SMTP:Message Submitted to Advanced Queuing
SMTP:Started Message Submission to Advanced Queue
SMTP:Message submitted to Categorizer
SMTP:Message Categorized and Queued for Routing
SMTP:Message Queued for Local Delivery
SMTP:Message delivered locally to
SMTP:Store Driver: Message Delivered Locally to Store to
share|improve this question
You'd have to post the message, including all headers. – Ward Nov 30 '11 at 4:32

I would not spend a lot of time trying to trace it. And frankly, if it is the only one, then I would not spend any more time even worrying about it. The message certainly came from outside the domain, because if Exchange is not set to relay, and there is no, then the message did not originate on your server. Forging the from address is very common in spam. So you do not have to worry about a virus/bot infested computer.

If you must, then (as Ward noted in the comment), you need to examine the message headers to find the IP address of the original sending machine. I con't recall exactly how to see the headers in Exchange 2003, but it can be done.

If there is a more serious spam problem, better to crank up the anti-spam features than to try and find individual culprits.

As an aside .. it really is time to suck it up and upgrade Exchange.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.