First, a tip of the hat to James3838 for solving the bluestell spamming problem.. Turns out there was an account with no password (created before I got here) that was the root cause. Once the account was disabled, the spamming stopped.
Course, now I'm absolutely paranoid, and I just found a curious event entry, id 13003. It reads:
Logon attempt from 168.144.108.41 to {user} has failed: HrLookupCredentials() call failed with error Logon failure: unknown user name or bad password..
The odd thing is that the user name was in the wrong format (we use first name last init, the user name listed was first init last name) and the user in question has never been set up for POP3 (her mailbox alias does not match her user name).
Anyone know what this is about? I assume spamming, no doubt.
Course, now I'm absolutely paranoid, and I just found a curious event entry, id 13003. It reads:
Logon attempt from 168.144.108.41 to {user} has failed: HrLookupCredentials() call failed with error Logon failure: unknown user name or bad password..
The odd thing is that the user name was in the wrong format (we use first name last init, the user name listed was first init last name) and the user in question has never been set up for POP3 (her mailbox alias does not match her user name).
Anyone know what this is about? I assume spamming, no doubt.
