repeating emails

[BrettSchwartz]

Emails are constantly coming to a specific user's mailbox.


I checked w/ the source and they are not seeing any activity that it's emailing from their server. Saying that... I need to find out why this user is constantly getting these messages. I know she is taking advantage of policy rules..... I'm not sure iof this is causing the constant messaging. I assume it's a rule that's making this happen... if it's not, what else should I look for?
Please advise
thanks
Brett

 

[BrettSchwartz]

checked rules.... nothing in there that is looping this email...

I did however get the header info...see below

Microsoft Mail Internet Headers Version 2.0

Received: from xxx.xxx.com ([x.x.x.x]) by exchange.bank.ufsbancorp.com with Microsoft SMTPSVC(6.0.3790.3959);

Sun, 24 Feb 2008 19:43:38 -0500

Received: from mail166.messagelabs.com (mail166.messagelabxtreame.com [x.x.x.x])

by xxx.xxx.com (BorderWare MXtreme Mail Firewall) with SMTP

id F9CB913E72; Sun, 24 Feb 2008 19:23:56 -0500 (EST)

X-VirusChecked: Checked

X-Env-Sender: jhuxxghes@xxx.com

X-Msg-Ref: server-9.tower-166.messagelabs.com!1203627591!17979939!1

X-StarScan-Version: 5.5.12.14.2; banners=xxx.com,-,-

X-Originating-IP: [207.190.252.100]

Received: (qmail 19781 invoked from network); 21 Feb 2008 20:59:52 -0000

Received: from xxx.fxxsisameday.com (HELO mail.lighthousecs.com) (207.190.252.100)

by server-9.tower-166.messagelabs.com with SMTP; 21 Feb 2008 20:59:52 -0000

X-MimeOLE: Produced By Microsoft Exchange V6.5

Content-class: urn:content-classes:message

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----_=_NextPart_001_01C874CC.B3890500"

Subject: Follow up

Date: Thu, 21 Feb 2008 15:59:50 -0500

Message-ID: <32D732BCAB2DDD4297322D3664FE97E7027F4C1E@searchlight.lighthousecs.com>

X-MS-Has-Attach: yes

X-MS-TNEF-Correlator:

Thread-Topic: Follow up

Thread-Index: Ach0zLLI76GcgoRkRa2NAMMdzw3FuA==

X-Priority: 1

Priority: Urgent

Importance: high

From: "Hughes, Jerry" <jhughes@xxx.com>

To: <Lau@xxx.com>, <be.the@xxx.com>

Cc: "Roache, Robert" <rroache@xxx.com>,

"DePalma, William" <wdepalma@xxx.com>,

"Franklin, Bill" <bfranklin@xxx.com>

X-BTI-AntiSpam: score:0,sta:0/028,dccassed,dnsblassed,swassed,bsn:none,Brightmailassed,spf:none,dkff,pbmf:none,ipr:0/6,trusted:no,ts:no,bs:no,ublff

Received-SPF: none

Return-Path: jhughes@xxx.com

X-OriginalArrivalTime: 25 Feb 2008 00:43:38.0710 (UTC) FILETIME=[760E6F60:01C87747]



------_=_NextPart_001_01C874CC.B3890500

Content-Type: multipart/alternative;

boundary="----_=_NextPart_002_01C874CC.B3890500"



------_=_NextPart_002_01C874CC.B3890500

Content-Type: text/plain;

charset="US-ASCII"

Content-Transfer-Encoding: quoted-printable



------_=_NextPart_002_01C874CC.B3890500

Content-Type: text/html;

charset="US-ASCII"

Content-Transfer-Encoding: quoted-printable





------_=_NextPart_002_01C874CC.B3890500--

------_=_NextPart_001_01C874CC.B3890500

Content-Type: application/octet-stream;


------_=_NextPart_001_01C874CC.B3890500--

 

[TweakMYbox]

Does the message tracking center show multiple copies of the incoming message?

Mike Fegan

http://www.tweakmybox.com

Learn how to tweak YOUR box, and talk shop with other techies!

 

[xmsre]

I'd look at firewalls as well. This is a known issue for several firewalls when the secure SMTP daemon is enabled.

Here's the article descibing the issue with Mailguard enabled on PIX.

http://support.microsoft.com/kb/295725/en-us

 

[BrettSchwartz]

How do I check this, I'm a novice at exchane 2003

 

[xmsre]

It's a firewall issue, not an exchange one. Telnet to port 25 on the outside inteface of the firewall and test or turn up your protocol logging and check the logs for

"Further testing with SMTP Protocol Logging can be used to pinpoint the failure in a message session. From a sample captured SMTP log below, observe the missing response of the receiving host to the CRLF.CRLF command.

2/7/01 5:01:20 PM : A connection was accepted from mail.domain1.com
2/7/01 5:01:21 PM : <<< HELO mail.domain1.com
2/7/01 5:01:21 PM : >>> 250 OK
2/7/01 5:01:21 PM : <<< MAIL From:<user@domain1.com>
2/7/01 5:01:21 PM : >>> 250 OK - mail from <user@domain1.com>
2/7/01 5:01:22 PM : <<< RCPT To:<user@domain2.com>
2/7/01 5:01:22 PM : >>> 250 OK - Recipient <user@domain2.com>
2/7/01 5:01:23 PM : <<< DATA
2/7/01 5:01:23 PM : >>> 354 Send data. End with CRLF.CRLF
2/7/01 5:05:44 PM : A connection was accepted from mail.domain3.com"