InstantForum.NET v4.1.4Ipswitch Forumshttp://forums.ipswitch.com/forums@ipswitch.comMon, 01 Dec 2008 17:06:32 GMT20http://forums.ipswitch.com/Topic484-10-1.aspx<P>You should first find the top authenticators; since everyone needs to authenticate, it is likely that an account password has been guessed or stolen. Look for 'authenticated &lt;username&gt;, session treated as local' in the logs. If there's an account with a very high relative number of authentications in a given day, that is probably the culprit. Change the password and see if that alleviates the abuse, and if the password does not appear easy to guess, also run a full system audit to make sure the IMail server has not been compromised.</P><P>There are also other methods of forensic log analysis, but try the above first.</P><P>--Sandy</P>Sat, 31 Jul 2004 01:16:25 GMTSanford Whitemanhttp://forums.ipswitch.com/Topic484-10-1.aspx<P>I have the daily reports being emailed to me and all of a sudden the remote deliveries went from ~400 per day to around ~5000 a day the last 2 days. I also find myself blocked from by users of spamcop.net. I am looking through the logs which are now in debug mode. What should I look for as to where these messages are being sent from? I have the server set to No Mail Relay. All my users have to authenticate to send mail.</P><P>Thanks in Advance.</P><P>Joe</P>Fri, 30 Jul 2004 14:29:58 GMTjoerake