Is my server sending SPAM?

Looking today at the Exchange message queue while dealing with a mail delivery problem and ran across about 25 entries that look like this:

Identity: FW-DC-1\88254\31761283153941
Subject: Undeliverable: Dear e759f257 Personal 70% OFF
Internet Message ID: <7be3e167-10b1-4c83-b9ad-08f1d147ecc6@FW-DC-1.Falcor.local>
From Address: <>
Status: Ready
Size (KB): 16
Message Source Name: DSN
Source IP:
SCL: -1
Date Received: 3/30/2014 1:16:42 AM
Expiration Time: 4/1/2014 1:16:42 AM
Last Error: 400 4.4.7 Message delayed
Queue ID: FW-DC-1\88254
Recipients:;2;2;[{LRT=};{LED=400 4.4.7 Message delayed};{FQDN=};{IP=}];0;CN=Internet,CN=Connections,CN=Exchange Routing Group (DWBGZMFD01QNBJR),CN=Routing Groups,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Falcor,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Falcor,DC=local

Running server 2008, Exchange 2013 Enterprise.  How do I tell where these are coming from?
Who is Participating?
Simon Butler (Sembee)Connect With a Mentor ConsultantCommented:
They are probably NDRs, where the server is rejecting email for non-valid recipients. Enabling recipient filtering on the server will stop them.

This is known as backscatter and doesn't mean your server is being abused.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.