We never figured out how the accounts were compromised. I suspect
another .edu here ..
how we've seen it happen is we get blasted by one of those "verify your
email account" messages.
despite our countless efforts at user education about responding to this
stuff, a dozen or so people always do (we try to configure outbound
filters to catch it, but don't always do so in time).
These accounts are then used by automated scripts to hammer on our
webmail (and ours is https, forced).
Most of the spammers' messages appear as though someone
is manually using their cut & paste to generate the spam,
not anything automated (based on the rate messages go out.
When we've had it happen, the messages are being relayed at a rate of
~10,000/hr.
Note that the messages sent *after* the compromise are NOT more of the
"verify your account" type .. they're run-of-the-mill pill and watch
adverts. The original "verify your account" stuff comes in from various
botnet PCs.
Cheers,
Michael Holstein
Cleveland State University
