Is my sendmail being hacked?

[ycs334]

I've called my hosting company many times but they are no help. Please, take a look at the maillog and other stuff and share your thoughts on this..
I do send out company newsletters every week using sendmail. But when I ran the command below, it has been a week since I sent about 5000 emails so there shouldn't be any emails in the mail que. Sendmail is alway the 1st place on the process list. And if I'm right, base on the maillog, admin1@mydomain.com seems to send emails to itself very very often. I don't get it.
And the email address j@i6cp.net that appears on the .forward file is something I am not awear of. Do any1 have an idea what is going on? Any help...


# top

11:12:40 up 9 days, 23:07, 1 user, load average: 3.41, 3.46, 2.93
113 processes: 111 sleeping, 2 running, 0 zombie, 0 stopped
CPU states: cpu user nice system irq softirq iowait idle
total 6.5% 0.0% 50.9% 0.0% 0.0% 0.0% 42.4%
Mem: 741284k av, 726648k used, 14636k free, 0k shrd, 59488k buff
326880k active, 290252k inactive
Swap: 522104k av, 51172k used, 470932k free 448096k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
7143 root 16 0 7748 7544 2692 R 48.2 1.0 12:21 0 sendmail
16907 root 16 0 7580 7388 2620 D 1.3 0.9 0:21 0 sendmail
12 root 15 0 0 0 0 DW 0.7 0.0 39:49 0 kjournald
19100 root 17 0 1244 1244 832 R 0.7 0.1 0:00 0 top
606 root 15 0 544 524 472 D 0.1 0.0 9:40 0 syslogd
1 root 16 0 456 432 400 S 0.0 0.0 0:12 0 init
2 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 keventd
3 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 kapmd
4 root 34 19 0 0 0 SWN 0.0 0.0 0:00 0 ksoftirqd/0
6 root 25 0 0 0 0 SW 0.0 0.0 0:00 0 bdflush
5 root 15 0 0 0 0 SW 0.0 0.0 4:25 0 kswapd
7 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 kupdated
8 root 22 0 0 0 0 SW 0.0 0.0 0:00 0 mdrecoveryd
65 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 khubd


#tail -f /var/log/maillog

May 30 11:21:18 admin1 sendmail[7143]: k4SIL3s9032123: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=1+22:00:15, xdelay=00:00:00, mailer=local, pri=3811249, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL
May 30 11:21:18 admin1 sendmail[26480]: k4TKH3kx011932: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=20:04:15, xdelay=00:00:00, mailer=local, pri=1651245, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL
May 30 11:21:18 admin1 sendmail[7143]: k4SIM4s9000673: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=1+21:59:14, xdelay=00:00:00, mailer=local, pri=3811249, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL
May 30 11:21:18 admin1 sendmail[26480]: k4TKI2kx012760: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=20:03:16, xdelay=00:00:00, mailer=local, pri=1651245, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL
May 30 11:21:18 admin1 sendmail[7143]: k4SIN3s9001659: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=1+21:58:15, xdelay=00:00:00, mailer=local, pri=3811249, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL
May 30 11:21:19 admin1 sendmail[26480]: k4TKJ4kx013715: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=20:02:15, xdelay=00:00:01, mailer=local, pri=1651245, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL
May 30 11:21:19 admin1 sendmail[7143]: k4SIO3s9002758: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=1+21:57:16, xdelay=00:00:00, mailer=local, pri=3811249, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL
May 30 11:21:19 admin1 sendmail[26480]: k4TKK7kx014629: to=<admin1@mydomain.com>, ctladdr=<admin1@mydomain.com> (502/502), delay=20:01:12, xdelay=00:00:00, mailer=local, pri=1651245, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL

#pstree -p -u -a

|-sendmail,20379
|-sendmail,720
| |-sendmail,14433
| |-sendmail,7143
| | `-procmail,27401,admin1 -f admin1@mydomain.com -t -Y -a -d admin1
| |-sendmail,26480
| | `-procmail,27378,admin1 -f MAILER-DAEMON@mydomain.com -t -Y -a -d admin1
| `-sendmail,16907
| `-procmail,27380,admin1 -f MAILER-DAEMON@mydomain.com -t -Y -a -d admin1
|-sendmail,729,smmsp
|-snmpd,669 -Lsd -Lf /dev/null -p /var/run/snmpd -a
|-spamd,644


#find / -name '.forward' -exec cat {} \; -print

/backup/local/synk/home/virtual/site1/fst/home/jere/.forward
user1@mydomain.com
/backup/local/synk/home/virtual/site1/fst/home/admin/.forward
user1@mydomain.com
/backup/local/synk/home/virtual/site1/fst/home/mydomain/.forward
user1@mydomain.com
/backup/local/synk/home/virtual/site3/fst/home/mydomain_2/.forward
support.mailbox@mydomain_2.com, support.check@mydomain_2.com
/backup/local/synk/home/virtual/site3/fst/home/support/.forward
user1@mydomain.com
/backup/local/synk/home/virtual/site6/fst/home/fsc/.forward
user2@mydomain.com
/backup/local/synk/home/virtual/site6/fst/home/mydomain/.forward
j@i6cp.net
/backup/local/synk/home/virtual/site6/fst/home/test/.forward

/backup/local/synk/home/virtual/site7/fst/home/lists/.forward
user1@mydomain.com
/home/virtual/site1/fst/home/admin/.forward
user1@mydomain.com
/home/virtual/site1/fst/home/mydomain/.forward

/home/virtual/site1/fst/home/jere/.forward
user1@mydomain.com
/home/virtual/site3/fst/home/mydomain_2/.forward
support.mailbox@mydomain_2.com, support.check@mydomain_2.com
/home/virtual/site3/fst/home/support/.forward
user2@mydomain.com
/home/virtual/site6/fst/home/mydomain/.forward
j@i6cp.net
/home/virtual/site6/fst/home/test/.forward
user1@mydomain.com
/home/virtual/site6/fst/home/fsc/.forward

/home/virtual/site7/fst/home/lists/.forward