We have two mail servers - Ex01 and EX02 - Both are in two different buildings and two different cities. Both are CAS/HUB/MBX.
We started to see slowness on the ISP for EX01 building. Started looking into it and we had over 43,000 SPAM messages in our queue trying to go out. Same two or three messages for all 43,000 messages.
I have found that they are originating from our EX02 server. EX02 is sending them over to EX01 and it is trying to send them out. I have disabled both receive connectors on the EX02 and they still keep coming as I was trying to rule out open relay.
Here is the SPAM message from Queue Viewer
Subject: SUPER PACK ESPIA la PC
Internet Message ID: <41168-220135416161941370@hello>
From Address: firstname.lastname@example.org
Size (KB): 640
Message Source Name: SMTP:Default EX01
Source IP: EX02
Date Received: 5/17/2013 8:57:23 AM
Expiration Time: 5/19/2013 8:57:23 AM
Queue ID: CHCS-SRV-02-01\137083
Question is how do i pinpoint down further what is going on. Right now i have the nic disabled in our vm for EX02 as it sends continuously when the nic is connected. Its about 300 messages a minute.
I have also ran virus and malware scans and found nothing on the server. No one uses the server for anything so there is no reason that malware should be on it.