failure notices from blank sender to 3rd party emails

[starchild2012]

Hi,

We constantly get failure notices showing up in our mail queuse with a blank sender and the recipient being a 3rd party email address that has nothing to do with our server.

We have turned relaying off in an attempt to stop our mail server from potentially being used to send spam - is there anything else we can do?

Is it simply a case of someone spoofing an email address on our server and the if the account doens't exist it bounces back via our mail server?

If so, can we put something in place to prevent these from coming in?

Any help is much appreciated.

Thanks, T

 

[atomicturtle]

the source could be through an exploitable web application, Ive put together a basic diagnostic procedure to determine if the source is from a web application, or an exploitable smtp_auth account here:

http://www.atomicorp.com/wiki/index.php/Spam