Slow SPAM relay problem

[frankygee]

I have SBS 2003 (exchange 2003 SP3), domain setup.
Have been dealing with a strange SPAM issue for the past week.
A number of users about 15 out of 40 appear to be sending SPAM messages. A total of about 150 messages per day.
I'm not sure where these messages ae comming from.

Have scanned the server and all PC's
The server is not relaying.
No account is being used as a relay.

Advice on the next step would be appricated.

 

[joepc]

Enable message tracking, Virtual SMTP server logging, and your queues to start.

The SPAM may not even be going out via Exchange. Your logs will and queue will assist you with this. Some virues install their own SMTP engine. Block outbound port 25 for all computers except the Exchange server to start.

Next make sure Exchange requires auth to send outbound mail. In addition if you are allowing relaying internally by IP make sure you didn't allow the entire local subnet for relaying.