>But, is it possible they altered their IP address and came in looking like >a local account?
They don't have to alter spoof their ip address to look legal, since "relay for local users" makes all internet addresses legal for relaying. If you were securing using "relay for addresses", you would also have to block ip-spoofing at your border router. Len http://MenAndMice.com/DNS-training http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
