how did a spam email generated and sent from my server?

my server is windows 2003 with exchange 2003. last couple days, number of accounts has sent out mails like these below samples. i can't figure out how it happen or if my server is infected or local user machines are infected with viruses. the email was sent out using authorized account and sent to the same account under alias address as below. different subject and body content were sent out each time.

From: Jeanine [mailto:firname_lastname@domainname.com]
Sent: Wednesday, June 14, 2006 1:55 PM
To: firstname lastname
Subject: RE: yOur pi11z r3quest
Importance: High

HOw are yOu Guys?!

Please open your mind for a simple thing
Internet provided products always cheaper than others.
You may agree or not, but this is a fact
Just compare the numbers and get the same goods for a half value
You may agree or not, but this is a fact

0HNiTsfUebnAZb9XR4DM
cuc888Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

smeekCommented:
Enable message tracking on your server properties in ESM.  Query on the next message you receive.  This is to make sure the messages were not just spooked emails (crafted to look like they came from your server).

You might also check and make sure the guest account in your domain is enabled?

You should also check and see if your server is an open relay.
http://www.abuse.net/relay.html

Steve
0
SembeeCommented:
Are you sure that the messages are coming from your server? You need to see the header information to confirm if they have originated off your machine, or the messages are spoofed.

If you are sure, then it could be either an open relay or authenticated user. If the machine is being used you can usually tell as there will be a large number of messages in the queues.
Authenticated user attacks are usually against the administrator account, so change that account password.
If you don't have any users outside relaying through your server with Outlook Express or similar SMTP product, then you don't even need authenticated relaying and can turn it off.

Simon.
0
cuc888Author Commented:
i've checked and it is not open for replay. i've looked at the queue and there is no large queue of unknown addresses. here is the header of one of the spam email. i can't tell where it is generated from.

Microsoft Mail Internet Headers Version 2.0
Received: from Robin ([172.30.6.1] RDNS failed) by mail.myserver.com with Microsoft SMTPSVC(6.0.3790.1830);
             Fri, 16 Jun 2006 06:31:51 -0700
Return-path: <firstname_lastname@myserver.com>
Received: from [142.135.192.72] (port=2710 helo=[142.135.192.72])
        by myserver.com with esmtp
        id 0ZKEf4-fZl291-83
        for firstname_lastname@myserver.com; Fri, 16 Jun 2006 08:01:51 -1000
Reply-To: Leanna <firstname_lastname@myserver.com>
Message-ID: <79158161.20060616080151@myserver.com>
From: Leanna <firstname_lastname@myserver.com>
To: <firstname@myserver.com>
Subject: Save your money, buy pills here!
Date: Fri, 16 Jun 2006 08:01:51 -1000
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0068_01C4B064.95321943"
X-Priority: 1
X-Mailer: The Bat! (v3.71.14) Home
X-Spam: Not detected
X-OriginalArrivalTime: 16 Jun 2006 13:31:51.0734 (UTC) FILETIME=[39F07D60:01C69149]

------=_NextPart_000_0068_01C4B064.95321943
Content-Type: text/html;
        charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_000_0068_01C4B064.95321943
Content-Type: image/gif;
Content-ID: <pOwi8GK9DRX0$HrwYoTHz$AK1WehJLQ@nMpW>
Content-Transfer-Encoding: base64


------=_NextPart_000_0068_01C4B064.95321943--
0
cuc888Author Commented:
is this where the email sent from?

Received: from [142.135.192.72] (port=2710 helo=[142.135.192.72])

i look at other headers of other spam emails and they are different on each one like this for example:
Received: from [81.229.108.74] (port=1758 helo=[81.229.108.74])

is this server problem or client?

0
SembeeCommented:
The presence of Internet headers means the message came from outside.
The first IP (142.135...) is from Canada. The second (81.229...) is Sweden.

It looks like standard spam, with one of their standard methods of putting your domain in both the from and the to line.

The messages aren't coming off your machine, which means there is nothing you can do about them.
Your spam filter should be dealing with these types of messages.

Simon.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.