Help with Exchange 2003 spam attack

Hello All,
A client's Exchange 2003 server is under attack and here's what I've been able to do so far.

This is a Windows 2003 SP2 server running Exchange 2003 SP2, all patches applied. We're using Outlook clients, OWA and IMAP.

Yesterday, user JW's e-mail account started getting hammered with NDRs with Chinese characters in the subject. I confirmed that the server is not an open relay. I found thousands of queues full of spam and got rid of them. The queues have been normal since. No more NDRs to that account.

They cracked JW's password and were authenticating. I could see it in the Security Event Log.

Successful Network Logon:
       User Name:      JW
       Domain:            MYDOMAIN
       Logon ID:            (0x0,0x72F915)
       Logon Type:      3
       Logon Process:      Advapi  
       Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
       Workstation Name:      MYSERVER
       Logon GUID:      -
       Caller User Name:      MYSERVER$
       Caller Domain:      MYDOMAIN
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID: 1436
       Transited Services: -
       Source Network Address:      -

If I change the password on JW's account, I see Failure Audits because the account gets locked out within seconds.

Logon Failure:
       Reason:            Account locked out
       User Name:      JW
       Domain:      
       Logon Type:      3
       Logon Process:      Advapi  
       Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
       Workstation Name:      MYSERVER
       Caller User Name:      MYSERVER$
       Caller Domain: MYDOMAIN
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID: 1436
       Transited Services: -
       Source Network Address:      -
       Source Port:      -

The main thing I'm still seeing are many sessions with weird user names in the Default SMTP Virtual Server. I checked a few of the IPs and they're in China.

My questions are:
- What are these sessions I'm seeing? I don't think the server is still sending spam. Wouldn't I see that in ESM in the queues?

- What to do about JW's account? It's currently disabled. If I enable it and reset the password it is locked out immediately. If I set the password back to what it was (as a test) I can see that they're successfully logging in.

I've scanned the server and all workstations for malware.

Next steps?

Thanks in advance