Here is what I would do in your case I would test changing the forwarding information of a mailbox via webmail.
Then in the webmail logs -Files in the spool directory that start with WXXXXXXX.log- I would locate today's webmail log file and study the effect of the change made in the testing mailbox. As for today log file name is W2040108.log I am pretty sure that you will find the cgi file that is called via webmail and the information of the user, ip, etc. Then just look for the cgi file called or other information unique to that change in the logs within the date range that the user think his account was used by the intruder. You may find at the end the IP that made that change. From that point on it will take a lot of time and effort to track down who was using that IP at the time. I hope it helps. Luis Arango -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bridges, Samantha Sent: Thursday, January 08, 2004 11:01 AM To: [EMAIL PROTECTED] Subject: [IMail Forum] Mail Forwarding Question Hello All. I have a user that suspects that another user got in to her mailbox via the web and changed her forwarding information. Would this be logged anywhere that this change occurred and at what time? Also which log would it be in. Samantha Samantha Bridges Communications Technician Macomb Intermediate School District 44001 Garfield Road Clinton Township MI 48038-1100 (586) 228-3300 [EMAIL PROTECTED] http://www.misd.net CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ______ [Email scanned for viruses by Panda Consulting -www.pandacons.com-] [Email escaneado contra virus por Panda Consulting -www.pandacons.com-] ______ [Email scanned for viruses by Panda Consulting -www.pandacons.com-] [Email escaneado contra virus por Panda Consulting -www.pandacons.com-] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
