If he authenticated, he must have guessed, or knows, one of the passwords for one of your users. I'd do 2 things, 1: notify the user who's accounts been compromised, and tell them about - B: you changed the password to the account. See if that stops the access. Now if it happens again, maybe the user is the cause..........
I saw that on one of our accounts and promptly changed it. You'ld be surprised the # of people that use password as the password. WHEN WILL THEY LEARN?????? Paul > I found the problem but I'm not so sure how to fix it. Apparently the > spammer managed to Authenticate and relay email even though I disable > the SMTP authentication. Do I just tick the option Disable SMTP "AUTH" > reporting under the SMTP security option? Could it be a security loop > hold in Imail. I guess someone managed to guess the password for the > email account. Did I miss anything here? > > Here is a copy of the log captured > > 03:31 23:38 SMTPD(000003DC) Authenticated > [EMAIL PROTECTED], session treated as local. --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
