> Jul 7 17:54:01 mx postfix/smtpd[31079]: disconnect from > localhost.localdomain[127.0.0.1]
It looks like the mail is coming from a process running on your server (localhost). Do you host any websites, run webmail or have any local users? If you're lucky, the "cleanup" line will contain a message id that give a clue as to it's creator. For example, this shows a message that came from squirrelmail. Jul 7 16:41:05 wormhole postfix/cleanup[27697]: 50237503FB: message-id=<d82e40699ae1412316736573384c8811.squir...@webmail.cnysupport.com> Terry
