Apologies if this is the wrong section (May be better in serverfault?)
Recently in doing a check of the logs I've found our system was for the last several days constantly attempting to mail somebody. Below is a copy of the mail log excerpt
May 4 17:14:51 li240-237 sm-mta[22961]: p3UN9oiX011581: to=<REDACTED@REDACTED.com>, delay=3+18:05:01, xdelay=00:00:01, mailer=esmtp, pri=48812230, relay=mx3.REDACTED*.com. [REDACTED], dsn=4.0.0, stat=Deferred: Connection refused by mx3.REDACTED*.com.
Does anyone have any ideas why so many attempts have been made and if I can track where these attempts are coming from? We do have a php based form which sends out an email to people upon confirmation of the submission and utilizes swiftMailer. Could this be constantly attempting to send the email for some reason?
My account has not been compromised and is the only one on the server aside from the root. The only other thought is someone attempting to send emails via our servers port 25...
Any ideas?