SPAM from inside?

[hrswift]

I'm running Exchange 2003 in a domain environment. A user mentioned to me that she had recieved SPAM from an internal user. This user hasn't been here for two years and her account was removed. How could this happen?

 

[jimthecanadian]

It would be possible if you accept smtp mail...very easy to spoof a user with smtp

 

[Spirit]

Look at the email header within outlook that will tell you where it came from.

It might say mike@yourco.com but if you look at the originating IP its probably very different from your mail server.

Iain

 

[ShackDaddy]

Spam originators often use spoof the from-address using other usernames in the same domain as the target recipient. It's very common. As was said above, checking the header will tell you who originating mailserver was, and you'll see that it wasn't any of your servers.

ShackDaddy

 

[Zelandakh]

Publish an SPF on your DNS and get your anti spam solution to check for failed SPF checks.