First off, I'd simply change the offending user's password and restart
qmail and dovecot. This will stop the spammer.
I'll have to give the rest some thought.
On 5/12/2017 8:28 PM, Jeff Koch wrote:
Hi Eric or List - maybe you can help with this puzzle.
We had an email account user whose username and password got to a
spammer. The spammer then sent out thousands of spams from our email
server using our user's credential. We caught the situation midway. To
stop the spamming we disabled the user's SMTP access stopped qmail and
then deleted everything from the all the queue folders.
We are now getting numerous failure notices from the server's
MAILER-DAEMON (which is odd because we had cleared the qmail queue)
and they are being attached to emails that were not the spam and sent
to user's that never did the spamming. We can't understand why this is
happening since after having stopped qmail and cleared the queue there
should have been nothing in the pipeline trying to be sent and if
there was a bounce-back it should have gone to the user whose
credentials were used originally to send out the spam.
Any ideas? Is email in the process of making multiple attempts at
sending being stored or queued outside of the qmail queue?
Jeff
--
Eric Broch
White Horse Technical Consulting (WHTC)
