Que filling up with SPAM from user account

[John]

Setup Exchange 2003 SP2

Outlook 2003

Last week I setup a users personal laptop to use RPC over http. I tested
the laptop on an external Internet connection to keep the system outside of
my network.

About 5 hrs after I set her up I started to receive the following warning
message from Exchange:

"A large number of messages are pending in the e-mail server send queue."

I went to the QUE and discovered approx 20 items in the Que that were listed
as retry. I checked to see whom the messages were from and discovered they
were from the same account that I setup earlier. I deleted the messages
with no NDR. I assumed that the users laptop was infected and told her to
not use the system to check her company email via Outlook bur instead use
OWA.

Since that time new SPAM messages are appearing in the que from the same
account. I even changed the password on the users account on Friday
thinking that she was still using her laptop at home.

So, I am looking for some feedback on how these new messages are appearing
if I have blocked access to the user and she is out on sick leave for 1
month.

I have scanned her desktop system for viruses and nothing has shown up.

Thanks

John

[Nuevo]

Turn on message tracking and look at your SMTP logs. Can you see where they
are coming from? Are they the same messages or different?

Nue
"John" <nos...@hotmail.com> wrote in message
news:%23ZrG4%235ZGH...@TK2MSFTNGP04.phx.gbl...

[John Chen [MSFT]]

Hello John,

Thank you for posting.

First, thanks to Nue for his good suggestion. Message Tracking and SMTP Log
are quite useful on this issue. I suggest you check the two logs.

According to my research, some virus will send SPAMs in a normal way. They
can send emails using a valid user credential. If it is convenient, please
temporarily disable the account for test.

If you find anything useful in the message tracking log or the SMTP log,
please let me know.

Sincerely,
John Chen, MCSE, MCSA, MCDBA, MCSD
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.