sbs2008 server, exchange 2007 latest service packs. Discovered an open relay on the server last night. 80,000 emails queued up.
They were going through a specific send connector I set up for a 3rd party application on a 2nd server on the LAN to relay email. I disabled the send connector and deleted the queue database. As soon as I enable that connector, the mails start flooding in again. I have AV on the 2nd server, and ran a MWB scan which all came up clean. The IP addresses all appear to be external and have been creating this event warning every few seconds.
The send connector is still disabled, however I created a fresh one and ran an open relay test on it and it passed. There are no messages stuck in the queue now and mail is flowing, however I'm concerned at the number of warnings appearing all coming from different IPs. The event ID relates to the new send connector that I created too.
Any insight would be appreciated.