Kirk Bocek: > Sep 24 11:10:12 amber postfix/pickup[12058]: 6C5C41FCB3: uid=497 > from=<bdnqkqhakis...@sfilc.com>
They are spamming through some local aplication, perhaps a web
service. What process is running as UID=497?
$ grep '497:' /etc/passwd
Wietse
