Few months ago, my host reported spam going from one of the 3 ips on our server. The host null routed the ip and all was good. We didn't have anything hosted on that ip so it wasn't a big deal.
The host is going to remove the null route since it's not a permanent fix. However, I still haven't been able to figure out the source of the problem.
How can I identify the glitch allowing spam to go through and close it? The server is Debian and I can see sendmail processes.
Note that the ip is null routed so I cannot do any external scans on it for open port until the null route is removed. However, removing the null route also opens up potential for new spam.
You can see the spam reports here: http://www.projecthoneypot.org/ip_18.104.22.168