View Single Post
Old 21st December 2012, 10:09
till till is online now
Super Moderator
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,414
Thanks: 834
Thanked 5,498 Times in 4,328 Posts

The account which is used is not configured at all.
This is the sender address and not nescessarily the account which is used to send the emails. Dont mix that up, thsender address and sending account can be the same but dont have to be the same!

I also do not see any authenticated user logged before this.
You have to find the login when the first spam email of a session is sent, there is no new login for each message.

There are 3 options:

1) The emails are send trough a local script.
3) The emails are sent trough a authenticated account.
4) Your server is a open relay (check:

If you want to find out more of the emails, then you can inspect their headers with postcat command in the queue.
Till Brehm
Get ISPConfig support and the ISPConfig 3 manual from
Reply With Quote