On Thu, Mar 30, 2023 at 12:00:01PM +0300, Reco wrote: > On Thu, Mar 30, 2023 at 09:30:49AM +0100, Julian Gilbey wrote: > > I wonder if anyone has any idea about how to track this down? > > I'd check /var/log/exim4/mainlog first, obviously.
In addition to that, open one of the spam messages in a competent MUA and examine the full headers. You should see one or more "Received:" headers. Every time the message is handed off to a new MTA, a new Received: header is prepended to the top of the message, so to read them in chronological order, you have to start at the bottom and work your way upward. So, look at the bottom-most Received: header first. Do you recognize either the sending or receiving system? If not, continue upward until you do. At some point, one of them should reveal where the message came from (i.e. who sent it to your computer). If your computer truly is cut off from the Internet as you say, then I would imagine you received it from another host on your local network. Be prepared for that.
