I'm running Exchange 2000 as part of SBS 2000 plus GFI MailEssentials to filter spam. A couple of weeks ago I noticed the GFI whitelist was filling up with nearly 2000 new addresses added daily. I tracked a couple of address that had been added in System Manager and the from address on these email was *@yahoo.com. I turned on SMTP logging and see a ton of emails that appear to be coming from inside with a yahoo.com from address. I've ran virus checks on all of our computers and all are clean. Any suggestions on how to track where these emails are coming from?