Tracking SPAM

I'm getting messages about the remote queue length being exceeded.  When I look at the SMTP queue there are messages from postmaster@<my domain>.com which are obviously SPAM. How do I tell where these are originating?  There is no "postmaster" account.  Message tracking does not tell me where they are originating.  SBS 2003, Exchange 2003.
HCPCJJ1Asked:
Who is Participating?
 
FeebleminderCommented:
Postmater@ are usually undeliverable messages. They are coming from a user inside.

In any case, have you looked at this KB?

http://support.microsoft.com/kb/886208
0
 
HCPCJJ1Author Commented:
Yes, recipient filtering was already enabled.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
FeebleminderCommented:
See if you have a user account that is created in AD that there is not a mailbox in Exchange for. If someone is sending emails out to a distribution group that a user is a part of, but no mailbox associated with, you can get these postmaster (NDR) messages.

Please Advise.
0
 
HCPCJJ1Author Commented:
We're only a 25 member organization.  No users without Exchange accounts.  These are definitely NDR messages with SPAM content.  I'm trying to determine why they're in my outbound queue.
0
 
FeebleminderCommented:
Check out this other Q&A for solutions. This might be your fix.

Please Advise!
0
 
HCPCJJ1Author Commented:
Very close.  The problem turned out to be NDR's for accounts that existed, but were disabled.  We're a law firm, so when a user leaves, I disable their account, but keep the EMails for sometimes years depending on their position.  Most of the users subscribe to multiple listserves, so the mail keeps coming in, but wasn't getting rejected by the recipient filtering because the account existed.  I was incorrect in assuming that it was SPAM.  It was legitimate mail to a disabled user.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.