View Single Post
Old 21st December 2012, 11:09
till till is offline
Super Moderator
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 37,015
Thanks: 840
Thanked 5,651 Times in 4,461 Posts

The account which is used is not configured at all.
This is the sender address and not nescessarily the account which is used to send the emails. Dont mix that up, thsender address and sending account can be the same but dont have to be the same!

I also do not see any authenticated user logged before this.
You have to find the login when the first spam email of a session is sent, there is no new login for each message.

There are 3 options:

1) The emails are send trough a local script.
3) The emails are sent trough a authenticated account.
4) Your server is a open relay (check:

If you want to find out more of the emails, then you can inspect their headers with postcat command in the queue.
Till Brehm
Get ISPConfig support and the ISPConfig 3 manual from
Reply With Quote