Spam E-mail Sending

[Enkrypted]

We seem to somehow have spam being sent through our server and I'm not sure of it's path of origin. I get all the NDR's e-mailed to me and they contain the following:

- E-mail is sent from System Administrator
- E-mail is sent to random people
- Error codes of #5.1.1 (e-mail account does not exist at the organization) and #5.2.1 (The message reached the recipient's e-mail system, but delivery was refused)

We did recently suffer from an attack of some sort (Massive amounts of e-mails backed up in queue). Since then I have installed updated virus software on all company PC's/Servers, scanned for viruses/malware and came up clean. Our exchange server is not set as an open relay and I have had 3 outside companies who specialize in Exchange security verify all settings/security is as it should be.
Because of those issues, we had our IP blacklisted with 4 blacklist providers. 3 of those have been taken care of and Tiopan is the only one we are still currently on. I've e-mailed them to remove us, but I also want to make sure this problem is fully resolved.

Does anyone have any idea how this could still be affecting us like this?

Enkrypted
A+

 

[58sniper]

Sounds like backscatter. Take a look at

http://spamlinks.net/prevent-secure-backscatter.htm

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/