View Single Post
  #6  
Old 21st December 2012, 10:09
till till is online now
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,388
Thanks: 833
Thanked 5,485 Times in 4,317 Posts
Default

Quote:
The account which is used webmaster@mcfcomplex.in is not configured at all.
This is the sender address and not nescessarily the account which is used to send the emails. Dont mix that up, thsender address and sending account can be the same but dont have to be the same!

Quote:
I also do not see any authenticated user logged before this.
You have to find the login when the first spam email of a session is sent, there is no new login for each message.

There are 3 options:

1) The emails are send trough a local script.
3) The emails are sent trough a authenticated account.
4) Your server is a open relay (check: http://mxtoolbox.com/diagnostic.aspx)

If you want to find out more of the emails, then you can inspect their headers with postcat command in the queue.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote