failed email tracking

[Richard B. Pyne]

I am seeing thousands (19000 today) of Illegal address syntax errors in 
my logs that I suspect are coming from malware attempting to send spam. 
The IP address shown is from our corporate firewall. The mail server is 
outside.

We require logging in to send mail, but I can't figure out how to track 
the real sender of the bad email addresses.

Any help on how to rack this down will be greatly appreciated.

--Richard