I am running Exchange 2007. I have one user who is spamming out from his email. I have scanned his machine with multiple scanners and his machine is coming back clean. I have turned off all of his equipment (laptop, iPhone and iPad) and the emails keep being sent through my server with his email address. I have ran multiple scans on my Exchange server and it comes back clean. I have used sites like MXToolBox to verify I'm not an Open Relay and those come back good.
When I look at the message queue on the server, I notice in the column that says "Message Source Name" when there are legitimate emails being sent from other users, that column says "Local". When there are SPAM messages being sent or held up, the "Message Source Name" column says "SMTP:Default-servername"
I cannot figure out how to find the reason for all of these SPAM messages. Any help would be appreciated.