I have a Postfix mail server.
The problem is it is sending spam. The logs showed the following:
538ED2BF7F2: client=unknown[103.214.xxx.xx] 538ED2BF7F2: message-id=<> 538ED2BF7F2: from=<email@example.com>, size=786, nrcpt=1 (queue active) 538ED2BF7F2: to=<firstname.lastname@example.org>, relay=gmail-smtp-in.l.google.com[184.108.40.206]:25, delay=4, delays=2.1/0.02/0.8/1, dsn=2.0.0, status=sent (250 2.0.0 OK 1501439317 91si6880315ply.391 - gsmtp) 538ED2BF7F2: removed
I have a wrapper for PHP & Apache and checked whether it was from a form or script on a website, but it wasn't: it was not being logged. And I checked HTTP logs for possible logins/post from the specific IP address, but nothing comes up.
Also I changed the password. The server is not open relay.
Any other ideas?
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination check_sender_access hash:/etc/postfix/sender_access reject_rbl_client zen.spamhaus.org reject_rbl_client bl.spamcop.net reject_rbl_client cbl.abuseat.org permit smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_rbl_client zen.spamhaus.org reject_unknown_reverse_client_hostname permit