I've looked in message tracking and also at the logs and cant find what I need.
We have a client pc sending hundreds of spam emails through our exchange server. Nothing open directly from exchange to the internet except https for owa. Relaying is disabled except for 4 ips which are other servers. Anyway, we have frozen a ton of them in the SMTP queue and message tracking shows them but doesn't say where they originate. They originate from 2 different accounts and it is possible that both of these users have logged onto the same computer. Part time faculty and they all share several computers. Any suggestions appreciated.
