Issue Outgoing mail from non-local user

[tkalfaoglu]

Regular postfix/spamassassin site here.. I am seeing in /var/log/maillog file, mail sent from a particular user, [email protected] where domain.com is hosted by us.. but they have no marinuser listed - the mailbox does not exist. the logs are full of mail like this:
Nov 27 03:21:57 ocean postfix/qmgr[23715]: 628A311E104A: from=<[email protected]>, size=1311, nrcpt=1 (queue active)

I blocked the suspected IP, created [email protected], set its outgoing limit to 1, but I am curious how they were able to send such emails, and why didn't Plesk or Postfix complain about outgoing mail from a non-existing local user?

Thanks
-t

 

[Bitpalast]

The part left of a domain is freely configurable in outgoing mails. When a script sends emails from a website, it can set the "from" field to anything, because a login is not needed.