Try looking at your IIS logs for the IP address and then look at your
accounting records.
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Bud
> Sent: Saturday, August 04, 2001 10:12 AM
> To: [EMAIL PROTECTED]
> Subject: [IMail Forum] Spamming from my server
>
>
> Hi all. It looks like one of my users may have created a mail form to
> send out spam. I'm getting a bunch of undeliverable messages back.
> Here is the header from one of the spooled files. Note that it's
> using DevMailer which is the command line mail program that my
> FormMail.pl uses. It's received from hosting1, which is me. How can I
> figure out who could be sending it?
>
> Received: from hosting1 [216.242.16.196] by mail.tropicalwebcreations.net
> (SMTPD32-6.05) id A9415201DE; Sat, 04 Aug 2001 12:56:33 -0400
> X-Mailer: DevMailer v1.0 (http://www.geocel.com/devmailer/)
> Date: Sat, 04 Aug 2001 12:56:33 Eastern Daylight Time
> From: Wendi Reese <[EMAIL PROTECTED]>
> To:
> [EMAIL PROTECTED],[EMAIL PROTECTED],[EMAIL PROTECTED],tjacox@ho
> tmail.com,[EMAIL PROTECTED],[EMAIL PROTECTED],tjadams@earthli
> nk.com,[EMAIL PROTECTED]
> Subject: RE:Summer Vacation
> MIME-Version: 1.0
> Content-type: multipart/mixed; boundary="#DM7321281#"
> Message-Id: <200108041256468.SM00334@hosting1>
> --
>
> Bud Schneehagen - Tropical Web Creations
>
> _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
> ColdFusion Solutions / eCommerce Development
> [EMAIL PROTECTED]
> http://www.twcreations.com/
> 954.721.3452
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
