>Could be but what puzzles me is that the message itself is a correct out of office notification.
Sorry I am asleep. If some one sends spam with a forged "from" address and Exchange generates an "Out-Of-Office" it will go to the forged from address. So if you users:- 1. Have out-of-office enabled 2. Receive spam with a Chinese subject and a forged "from" address which belongs to another one of your users. 3. Exchange will generate an Out-Of-Offce as you describe. 4. Message Tracking will show this as a purley internal message. Dave Wade Business Services I.C.T. 0161 474 5456 ________________________________ From: Young, Philip [mailto:philip.yo...@covance.com] Sent: 11 March 2011 13:34 To: MS-Exchange Admin Issues Subject: RE: OOO issue looks like spam Are any of the replies coming from delegates to the original recipients? We get that quite a lot. Regards Phil Young Global Messaging Admin ________________________________ From: Al Rose [mailto:arose...@gmail.com] Sent: 11 March 2011 11:46 To: MS-Exchange Admin Issues Subject: Re: OOO issue looks like spam On Fri, Mar 11, 2011 at 12:32 PM, Dave Wade <dave.w...@stockport.gov.uk> wrote: Some one validating e-mail addresses before sending spam? Dave Wade ________________________________ From: Al Rose [mailto:arose...@gmail.com] Sent: 11 March 2011 11:11 To: MS-Exchange Admin Issues Subject: OOO issue looks like spam Hello all, Since a few days a random number of users are receiving Out of Office notifications from users that they didnt even send an email to... This does not look like spam as this comes from domain users. I have checked headers but they are empty. The other weird thing is that they are usually with the mail message written in Chinese whereas users are not using Chinese language. Anyone got any clue? --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist ********************************************************************** 27 March 2011 is National Census Day. Get behind Stockport. Remember to complete and return your questionnaire to make sure Census 2011 helps us accurately understand what Stockport needs for the next 10 years. For more information, please go to www.stockport.gov.uk/census This email, and any files transmitted with it, is confidential and intended solely for the use of the individual or entity to whom they are addressed. As a public body, the Council may be required to disclose this email, or any response to it, under the Freedom of Information Act 2000, unless the information in it is covered by one of the exemptions in the Act. If you receive this email in error please notify Stockport ICT, Business Services via email.qu...@stockport.gov.uk and then permanently remove it from your system. Thank you. http://www.stockport.gov.uk ********************************************************************** --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist ----------------------------------------------------- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or reliance upon the contents of this e-mail is strictly prohibited. If you have received this e-mail transmission in error, please reply to the sender, so that we can arrange for proper delivery, and then please delete the message from your inbox. Thank you. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist