I have this issue where I receive on my server admin e-mail failure notices to a lot of e-mails that I or my hosted domains did not send.
The machine is an Ubuntu with Plesk 11. For e-mail I use qmail, which is the standard this server has.
Every user is allowed to send e-mail based on SMTP authentication. However some e-mails did get past that.
Here is a header from such an e-mail which I cannot trace to its origin (the pipe through which it is coming)
Received: (qmail 13781 invoked from network); 28 Apr 2014 17:15:42 +0300 Received: from XXXXXXXXXXXXXXXXX (HELO User) (XXXXXX) by XXXXXX with ESMTPA; 28 Apr 2014 17:15:41 +0300 Reply-To: someemail From: someemail Subject: some spam email subject Date: Mon, 28 Apr 2014 16:15:41 +0200 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_00E5_01C2A75B.10F0C4E2" X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
What I can trace from this header is that the user sent the e-mail using Outlook express and authenticating with ESMTPA. The problem is that I do not know how to trace it further.