Exchange System Undeliverable's Spam or Rogue server?

Guys,

I need some urgent help. My users are receiving a bunch of System Undeliverable emails,a bout 50-100 at once maybe once a day for a random person.

it's showing as if the user is sending out the email and it's bouncing back to them saying the person they are sending it to does not exist.

How can i prevent this from happening and figure out if something on my network is sending out email? I've checked my system manager and tried to track the messages but i do not see  any messages sent from these users to the people in the system undeliverable emails.

I've also checked on port 25 and do not see anything suspicious but i do not have a constant monitor on port 25. Throughout the day however when i look at whose connecting through port 25 from my firewall it just shows the exchange server.

If this is a new way of spam can someone explain to me how they are getting this spam through so i can explain to my CTO? and also how can i prevent the users from getting all the undeliverables?

Thanks so much for your help.