Spam Trojan(Bot)

I have a client that is using Exchange (with 3 domain names 2 using POP connectors).  One of the user machines(workstation) is getting random responses from email that she is not sending through Outlook 2003.  The message appears to be Spam related of some sort.  This client has been infected with Spamming trojans in the past which has led that domain to be black-listed.  Here is the response she has been getting.  She has gotten only 4 today but all say the same thing:
     "-----Original Message-----
From: MAILER-DAEMON@ns201603.ovh.net
[mailto:MAILER-DAEMON@ns201603.ovh.net]
Sent: Monday, September 22, 2008 8:10 AM
To: #########
Subject: failure notice

Hi. This is the qmail-send program at ns201603.ovh.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<inthally_1978@KEUMGAY.COM>:
Sorry, no mailbox here by that name. vpopmail (#5.1.1)

--- Below this line is a copy of the message.

Return-Path: <########@stallioncompany.com>
Received: (qmail 31491 invoked by uid 503); 22 Sep 2008 12:09:40 -0000
Received: from unknown (HELO mail.stallioncompany.com) (209.60.142.106)
  by ns201603.ovh.net with SMTP; 22 Sep 2008 12:09:40 -0000
Content-class: urn:content-classes:mdn
MIME-Version: 1.0
Content-Type: multipart/report;
      report-type=disposition-notification;
      boundary="----_=_NextPart_001_01C91CAC.169B6FD3"
Subject: Not read: Release your fantasies tonight.
X-MimeOLE: Produced By Microsoft Exchange V6.5.7235.2
Date: Mon, 22 Sep 2008 08:09:39 -0400
Message-ID: <EE5250848A540142B83713BD60BC9DAB0A41B1@esserver.ES.local>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Release your fantasies tonight.
Thread-Index: AckcnqOX4RnB8/OeT1a+dWtNFGOJqwADXMHN
From: "########" <########@stallioncompany.com>
To: "Belven" <inthally_1978@KEUMGAY.COM>

This is a multi-part message in MIME format.

------_=_NextPart_001_01C91CAC.169B6FD3
Content-Type: text/plain;
      charset="utf-8"
Content-Transfer-Encoding: base64

WW91ciBtZXNzYWdlDQoNCiAgVG86ICAgICAgRXJpbiBSb2JpbnNvbg0KICBTdWJqZWN0OiBS
ZWxl
YXNlIHlvdXIgZmFudGFzaWVzIHRvbmlnaHQuDQogIFNlbnQ6ICAgIE1vbiwgMjIgU2VwIDIw
MDgg
MDY6MzM6MTcgLTA0MDANCg0Kd2FzIG5vdCByZWFkTW9uLCAyMiBTZXAgMjAwOCAwODowOToz
OSAt
MDQwMOCojQ0K

------_=_NextPart_001_01C91CAC.169B6FD3
Content-Type: message/disposition-notification
Content-Transfer-Encoding: 7bit

Final-Recipient: RFC822; ########@stallioncompany.com
Disposition: automatic-action/MDN-sent-automatically; deleted
X-MSExch-Correlation-Key: GBTFJRVBq06age6LrqmsyA==
Original-Message-ID:
<54084.242.344.731.839.1334306992.squirrel@KEUMGAY.COM>

------_=_NextPart_001_01C91CAC.169B6FD3--   "


I removed the username and email address and replaced with ######## but the domain is correct.

I have used 3 different virus scans to search and have found nothing on the PC.  

I have 3 questions:
1. Does this appear to be a Spamming Trojan(bot)?
2. How else can I scan the PC for such malware?
3. Is it possible this malware is on the Exchange server and not the client?  I have scanned the server for viruses and found nothing as well.
Start Free Trial