[IMail Forum] loads of mail in spool

[Richard Ware]

Bear with me, I’ve looked extensively for the answer but to no avail. First a brief synopsis of our set up.   Mail comes through the firewall into an NAI E500 on to our mailserver running NAI webshield then into imail 8.0.   If I clear the spool directory, after a while I get messages appearing every 10 mins with loads of the bellow in the body.   Received: from excalibur.TTPGroup.com [172.16.40.30] by excalibur.techprt.co.uk   (SMTPD32-8.00) id AB595330188; Thu, 27 Nov 2003 00:54:49 +0000 Received: FROM excalibur.techprt.co.uk BY excalibur.TTPGroup.com ; Thu Nov 27 00:54:49 2003 0000 Received: from excalibur.TTPGroup.com [172.16.40.30] by excalibur.techprt.co.uk   (SMTPD32-8.00) id AB595320188; Thu, 27 Nov 2003 00:54:49 +0000 Received: FROM excalibur.techprt.co.uk BY excalibur.TTPGroup.com ; Thu Nov 27 00:54:48 2003 0000 Received: from excalibur.TTPGroup.com [172.16.40.30] by excalibur.techprt.co.uk   (SMTPD32-8.00) id AB585310188; Thu, 27 Nov 2003 00:54:48 +0000 Received: FROM excalibur.techprt.co.uk BY excalibur.TTPGroup.com ; Thu Nov 27 00:54:48 2003 0000 Received: from excalibur.TTPGroup.com [172.16.40.30] by excalibur.techprt.co.uk   (SMTPD32-8.00) id AB585300188; Thu, 27 Nov 2003 00:54:48 +0000 Received: FROM excalibur.techprt.co.uk BY excalibur.TTPGroup.com ; Thu Nov 27 00:54:47 2003 0000 Received: from excalibur.TTPGroup.com [172.16.40.30] by excalibur.techprt.co.uk   (SMTPD32-8.00) id AB5752F0188; Thu, 27 Nov 2003 00:54:47 +0000 Received: FROM excalibur.techprt.co.uk BY excalibur.TTPGroup.com ; Thu Nov 27 00:54:47 2003 0000 Received: from excalibur.TTPGroup.com [172.16.40.30] by excalibur.techprt.co.uk   (SMTPD32-8.00) id AB5752D0188; Thu, 27 Nov 2003 00:54:47 +0000 From: Webshield SMTP V4.5 MR1a Mail Service Date: Thu Nov 27 00:54:47 2003 To: <[EMAIL PROTECTED]> Subject: Returned Mail: Error During Delivery Message-Id: <[EMAIL PROTECTED]>   ------ Here is your List of Failed Recipients ------ [EMAIL PROTECTED]   This just repeats itself throughout the email. I put a block on the E500 for the domain, but they still kept appearing. Only after I put the domain on the webshield (runs on the mail server as port 25) did the messages stop. This implies to me that the messages are originating from inside my network. Upon looking at the mail logs on the webshield, it states the originating ip address is 127.0.0.1   Can anyone point me in the direction of where this is steming from. (I know I;ve stopped it, I just need to know)   Thanks