Big problem in Plesk 9.5.2

[CesarV]

Good morning.

I use CentOS 5.5 with Plesk 9.5.2 and my clients are receiving many emails with the subject Viagra, meds, etc.. Recently I updated the CentOS version 5.4 to 5.5. Previously this problem was not occurring. The strange thing is that I get these emails from my own email address, as if I'm sending to myself. Plesk uses SMTP authentication and there is no more open relay except the localhost.

Is there another way to improve the rules and signatures of Spamassassin or what would be the best way to solve this problem?

Thanks.

 

[64bithost.com]

My favorite email

Dear ([email protected])

this is the support department:

Your email has been compromised and it is not wise to open this email.

regards

[email protected]

( believe it or not I actually have a log file of 203 actual email attacks from the same guy )

 

[64bithost.com]

example

From - Wed Sep 1 03:17:29 2010
X-Account-Key: account3
X-UIDL: UID5785-1275813779
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from plesk1.64bithost.com (unknown [127.0.0.1])
by plesk1.64bithost.com (Postfix) with ESMTP id 6409B4508442
for <[email protected]>; Wed, 1 Sep 2010 06:03:57 +0000 (UTC)
Received: from microsof-fd7f6e (unknown [92.46.242.62])
by plesk1.64bithost.com (Postfix) with SMTP
for <[email protected]>; Wed, 1 Sep 2010 06:03:57 +0000 (UTC)
From: [email protected]
To: [email protected]
Subject: [email protected] V|AGRA ® Official Seller -52%
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <[email protected]>
Date: Wed, 1 Sep 2010 02:03:57 -0400 (EDT)

 

[64bithost.com]

Spammer

This particular spammer is located here

14 ural-agr-1.online.kz (92.47.151.110) 217.012 ms 217.012 ms 216.987 ms
15 82.200.230.5 (82.200.230.5) 223.161 ms 225.617 ms 225.590 ms