>One thing I noticed at least on my system is it bypassed the mx (imgate) and >sent directly to the mailbox server (imail) and the mailbox server is not >listed as a mx.
yep, spammers scan all IPs for port 25 and try to send to any IP listening on port 25. Len
