I think this is what you need and after looking at this I see how they got through. They either guessed the test username and password or got it some other way? I see that they change the from address every so often during the process, would hijack still catch that?
03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] EHLO smtp0842.mail.yahoo.com 03:10 00:42 SMTPD(00000590) Authenticated [EMAIL PROTECTED], session treated as local. 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] MAIL FROM:<[EMAIL PROTECTED]> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] RCPT TO:<[EMAIL PROTECTED] BRIAN> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] RCPT TO:<[EMAIL PROTECTED] ANDRE> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] RCPT TO:<[EMAIL PROTECTED] TONY> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] C:\IMail\spool\D4ff90e1900aa847d.SMD 1301 03:10 00:42 SMTP-(00000A84) processing C:\IMail\spool\Q4ff90e1900aa847d.SMD 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] MAIL FROM:<[EMAIL PROTECTED]> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] RCPT TO:<[EMAIL PROTECTED] AKSHAY> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] RCPT TO:<[EMAIL PROTECTED] MAHER> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] RCPT TO:<[EMAIL PROTECTED] ALAN> 03:10 00:42 SMTPD(0E1900AA) [216.129.206.54] C:\IMail\spool\D4ffc0e1900aa9007.SMD 1308 Thanks, Brian To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
