Top User of Mail

Hi,

We have a user that keeps showing up consistently as the top user of mail according to a daily report that is run from a reporting software that gets data fed to it from our corporate firewall.

The user only connects to his mailbox using OWA (Outlook Web Access) on a exchange 2010 server. The PC that he logs into has a generic login so that is why he connects to exchange using OWA. We have scanned on the PC to ensure that there aren't any viruses, the PC has come back clean. Other users connect to their mailbox via OWA on this PC as well and are not showing up as a top user of mail the same as this user does.

Does anyone have any ideas as to how he could be showing up as the top user of mail day after day?

Any help on this would be greatly appreciated.

Thank-you in advance for taking the time to respond back.

ElliTech
ellitechAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Nick RhodeIT DirectorCommented:
I would try reseting the users password.  Could have had his U/N and Pass hijacked and now email is relaying from your server from an external source.  I would also check his PC and do a thorough scan.  You can follow this guide for assistance.

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/Desktop_Anti-Virus/A_12285-Virus-Removal-Methods.html

Now when you have him as the Top user.  Is the email significant like he is sending out 2000 more messages than everyone else etc?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ellitechAuthor Commented:
I looked at the report and he have 1643 events whereas the next highest user has 21.

Pretty significant difference.

ElliTech
0
ellitechAuthor Commented:
324.702 MBytes versus 28.907 MBytes of data sent via OWA. I am going to reset the users password and see if that makes a difference.

Thanks for your help...

ElliTech
0
ellitechAuthor Commented:
Thanks, I have reset his password, the PC was already scanned and we'll see tomorrow morning when the next report comes out.

Thanks...

ElliTech
0
Nick RhodeIT DirectorCommented:
Just keep an eye on it for some viruses cannot be picked up by windows scanners.  Possibly a little keylogger of somesort but you never know :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.