Hi Eric or List - maybe you can help with this puzzle.
We had an email account user whose username and password got to a spammer. The spammer then sent out thousands of spams from our email server using our user's credential. We caught the situation midway. To stop the spamming we disabled the user's SMTP access stopped qmail and then deleted everything from the all the queue folders.
We are now getting numerous failure notices from the server's MAILER-DAEMON (which is odd because we had cleared the qmail queue) and they are being attached to emails that were not the spam and sent to user's that never did the spamming. We can't understand why this is happening since after having stopped qmail and cleared the queue there should have been nothing in the pipeline trying to be sent and if there was a bounce-back it should have gone to the user whose credentials were used originally to send out the spam.
Any ideas? Is email in the process of making multiple attempts at sending being stored or queued outside of the qmail queue?
Jeff
