Spam Problems (Exchange 2003)

[Ratatapa]

I have a user in at my new clients that seems to be spamming

Here is the info and this is how it was setup when we got this client (we need toc hange everything in july)

Server is SBS 2003 with Exchange they have a google postini account for SPAM filtering.

The user that seems to spam is not in the company anymore so we transformed his email as forward only (normally forward email are not suppose to be able to send) Also the user is still in AD and has a different email for now like [email protected]

So the user who is the local boss and the one who the old user email is forwared to send me a message with the Postini quarantine saying that [email protected] is sending spam

But there is 2 strange things

1) Like i said the adress is to a forwared email group and if i look into the message log of Exchnage with the sender, i see 0 emails from that account.

Also my server is not Open Relay

What else can i check?

Thanks (PS Postini blocks the sending but the user still wanna know wtf is happening)

[Hellfury]

Have you verified that the sender IP of the e-mail is in the company IP range (and on the client the user uses), so that its not some external source merely giving up the wrong sender info [possibly through logging in via VPN or equivalent]?
(of course, IP could be spoofed as well)

[xerodok]

Disable his account and reduce his mailbox to 0MB.

[xopher]

Have you verified that the sender IP of the e-mail is in the company IP range (and on the client the user uses), so that its not some external source merely giving up the wrong sender info [possibly through logging in via VPN or equivalent]?
(of course, IP could be spoofed as well)

This. Have you absolutely determined the spam is coming from this account?

[Ratatapa]

Problem solved, the Idiot of client didn't check the dates, and those spam were from before we got the client ...

Thanks lol

[Meresgi]

Problem solved, the Idiot of client didn't (insert)

Hey that's like 100% of all the issues I have to deal with!