Spam

If n0_reply@e-mailusa.info is the email address and doesn't match your actual domain name, it means your mail server was operating as an open relay. I wrote a blog post on the subject a while back here: http://acbrownit.wordpress.com/2012/05/02/exchange-2010-relaying-how-to-use-it-how-to-turn-it-off/

Possibly not an open relay, the attacker could have brute forced some credential on your network and authenticated to your server to send mail out through it.

If you have SMTP logging turned on, you may well find something there that will help you identify the account that was used (important, if that was the case) and the IP address from which the connection was made (which will tell you if it was a machine inside the network or something outside).

In the header above, it looks like a device at 200.207.87.225 was what originated the email and connected to your Exchange server to send it. Verifying this against the SMTP logs would be nice.

If you have an "email security host," which you appear to also be using as a smart host, I have to think that legitimate inbound email to your domain would come to them first as a public MX record, and then back to your Exchange server. In this case, your receive connector should be configured to only accept connections from the IPs your email security host provides as legitimately theirs. If you have a need to have devices on your network do internal relay, you should make a second "Internal Relay" receive connector, specifying the IPs of the devices which have permission to use it, and with only "Exchange Servers" permission group checked.

Hello,
I have read Alan's articles and after investigation, I found this:
Note: Diagnostic logging for Authentication seems to have been set to Maximum for quite a while now.  It seems I have forgot to switch it off last time I faced a similar attack.  Also, I am not an open relay according to this site http://www.checkor.com/.
1 -  Indeed, event ID 1708 is infesting Application log.  However, there are two accounts, not one.  But, among hundreds of entries of event 1708, only four are for one user account and the rest are for the other account. That account's name is "test" and with an easy password.  Also, the Exchange logs show account "test" along with its password against the IP from which the emails were sent.  They also show that the client name is "User" (check point 2 below). So, my guess is that this might be the "open gate" through which the hacker came in. Please comment.
2 - The body of the event log entry reads "SMTP Authentication was performed successfully with client "User".  The authentication method was "LOGIN" and the username was "MyLocalDomain\test".
In some other entries, the client name changes to "SERVER", "CLONE" and "UserPC".  Is this the name of the machine?  If yes, I confirm that none of these machine names exist in my Active Directory.  Is it so that it is a remote attack?  Please comment.
3 – I also found a wealth of NDRs (in the Queue folder on the hard disk) queued  for sending from postmaster@mydomain.com to simon@capital-bd.com.  These NDRs state that delivery to victim(s)@domain(s).com  failed.  simon@capital-bd.com is the email address used to send spam to loads of victim recipients from my server.
I believe this is not the type of NDRs referred to in the article, which are called Backscatter.  In my case, all NDR's are going out to a single email address that the emails they have sent failed to deliver.
4 – After cleaning logs, deleting test account, restarting SMTP service and while writing this reply, some 1669 NDRs queued again (in ESM) to the same email address.  The weird thing here is that among those 1669 NDRs, some 600+ have no message ID, subject, sender nor recipient.  Also, Queue folder on the hard disk is still empty.  Where those NDRs are coming from and where are the actual emails residing?  Please comment.
I also need the following information so that I can stop this kind of attacks before it inflicts havoc:
1 – Is it possible to limit the number of outbound emails per user over a certain period of time?
2 – Is there a way to have Exchange alert me when Queues inflate?

Regards
Yahya

Yes - that is a remote Authenticated Relay Attack.

If you want to stop this for good and make sure it doesn't happen again, follow the advice in my blogs about password security and then remove Integrated Windows and Basic Authentication from your SMTP Virtual Server - it then cannot happen again in the same way.

To empty the queues, you can use aqadmcli.exe

The download link no longer works, but I have a copy of the file if you want one.

Alan

Hello,
Everything is in order now and I am grateful experts. And yes, I would appreciate a copy of that tool please.

What about these two questions:

1 – Is it possible to limit the number of outbound emails per user over a certain period of time?
2 – Is there a way to have Exchange alert me when Queues inflate?

Yahya

Good news.

To answer your questions (sorry I missed them earlier):

1. No
2. Not without 3rd party software

File is at http://www.sohotechnology.co.uk/372368_intl_i386_zip.exe

Alan tackled the problem with insight expertise.