I should have included headers from the spam email. They are below.
2008/1/24, Zbigniew Szalbot <[EMAIL PROTECTED]>:
> Hello,
>
> I'd like to ask for help in interpreting the below log. Do I have a
> problem on my machine? That is, is someone sending emails really from
> localhost?
>
> 2008-01-24 12:40:01 1JI0R7-000L99-Ps <=
> [EMAIL PROTECTED] H=localhost (lists.lc-words.com)
> [127.0.0.1] P=esmtp S=8600
> [EMAIL PROTECTED]
> 2008-01-24 12:40:02 1JI0R7-000L99-Ps =>
> /var/spool/virtual/lists.lc-words.com/postmaster/Maildir
> <[EMAIL PROTECTED]> R=virtual_domains T=virtual_delivery
> DT=0s
> 2008-01-24 12:40:02 1JI0R7-000L99-Ps Completed
>
> There should be no localhost sender on this machine so if there is
> one, then I do have a script somewhere on the HD!
>
> Many thanks for your help!
>
> Zbigniew Szalbot
>
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Received: from localhost ([127.0.0.1] helo=lists.lc-words.com)
by lists.lc-words.com with esmtp (Exim 4.69 (FreeBSD))
(envelope-from <[EMAIL PROTECTED]>)
id 1JI0R7-000L99-Ps
for [EMAIL PROTECTED]; Thu, 24 Jan 2008 12:40:01 +0100
Received: from localhost.lists.lc-words.com [127.0.0.1]
by lists.lc-words.com with POP3 (fetchmail-6.3.8)
for <[EMAIL PROTECTED]> (single-drop); Thu, 24 Jan 2008
12:40:01 +0100 (CET)
Received: from host184-68-static.4-79-b.business.telecomitalia.it
([79.4.68.184])
by lists.lc-words.com with smtp (Exim 4.69 (FreeBSD))
(envelope-from <[EMAIL PROTECTED]>)
id 1JI091-000Kno-GN
for [EMAIL PROTECTED]; Thu, 24 Jan 2008 12:21:24 +0100
Content-Return: allowed
Thank you again!
Zbigniew Szalbot
--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
