Tracking the source of internal spam

Hello,

We are trying to isolate a spam issue where our users are recieving NDR messages from
mailer-daemon@companyXXX.com.  These original messages are obviously spam and the spammer is using our legitimate users as spoofed sender addresses.

Our firewall is configured to only allow outbound smtp messages from our mail server and I have verified that no other device is sending smtp packets.  Using ethereal I can see that there is no client sending smtp emails and relaying them off of our exchange server however is it possible for a virus or spam bot to be sending these messages via another protocol?

Any suggestions on troubeshooting further would be appreciated.  My believe is that this is originating outside of our network from an infected home machine or harvested email addresses however I am having difficulty proving.

Thank you,

brianStart Free Trial