NDR Attacks

My Exchange 2000 server is being hit with 3,000-5,000 NDR type of emails every day.  By reading the various yet excelent posts here at EE, I have implemented the following steps:

- Relaying is turned off and has been verified using telnet, ehlo, mail from, rcpt to etc.  The checkbox to "allow all authenticated computers to relay" is NOT checked.

- The number of connections to the SMTP server is limited to five connections with a 10-minute timeout.

- In Exchange System Manager, the ability to send NDR reports is disabled (not checked).  This is still enabling NDR to our internal users as expected.

- The badmail directory is emptied nightly with a cleanup script.


As a result of implementing the above steps, two things have happened:

- The SMPT Queues have gone way way way down which is resulting in a lower CPU usage.

- The badmail directory is not getting as full.  Instead of 4,000 badmails per day, only a few hundred are appearing in the directory.


So I have a few questions:

1) Are the above steps satisfactory to prevent relaying?  Is five connections too little?

2) Since I can't stop the incoming NDRs into Exchange 2000 (unless I had an appliance), I can definitely stop the NDRs from leaving Exchange.  Are the above steps satisfactory in achieving this?

3) And perhaps the most important question.  If the NDRs that continue to come in are "bad mail", why is my badmail directory not filling up at the same rate BEFORE disabling the NDR features?


(heavy points due to some insightful advice sure to follow...)