Recently I began receiving AOL spam feedback reports from our exchange server. As I investigated I found that hundreds of spam messages were being relayed through our exchange server. Although I am having trouble figuring out why.
The tracking log shows the receive and send SMTP events for each spam message originating from an ip that reverse lookups to Washington DC.
It appears that they are hitting our server between 2am-4am every other night. Hitting different domains each night as well.
The spam is an image pulled from a russian site. The sender and recipient address are the same so that the user is tricked into opening it.
I checked our receive connectors and our send connector configuration and everything seams to be configured properly. I ran an open relay check from MXtools and it passed. I used an smtp tool to attempt to relay a message and I could not, unless I authenticated. As an authenticated user I was able to relay a message from an external address to an external address.
Which leads me to believe the spammer is connecting via an authenticated user smtp session. However I have absolutely no idea how to look through Exchange logs to see what user they authenticated as, or even how they were able to relay the message through Exchange.
Can anyone shed any light on this?