Mail server sending plenty of mails

Question

My mail server was sending plenty of dummy emails using a user mail account, most of them were stuck in my mail queue due to blacklist/ graylist failure at first i tried to change the user's mail password to more complex one, but the issue still exists, and the user confirms he never used his email for sending any mails,

I also tried to use some php script to send email using my account without SMTP authentication, and it failed,

>SMTP -> get_lines(): $data is "554 5.7.1 <[email protected]>: Relay access denied

So how can someone use my mail server to do so?!

Answer 1

There are many possible causes for such an issue. here are the most likely:

• You have a badly designed form script on one of your web server. It us being abused by spammers to send their messages. Note that the problematic script could be on a different server: check your logs to see where the messages come from.
• One (or more) of your users account have been compromised and is being used to relay spam. In this case, you should disable the problematic user, force a password reset and contact the responsible person with the bad news. Usually, you will know it's an account compromise because it is being logged on from unknown IPs when sending spam. You might want to enforce password complexity on all your mail users and, if you do not have it already, setup the system to automatically lock SMTP accounts after a number of failures (5 to 10 are often enough without being too punishing on your users).
• Your SMTP server is improperly configured and it allows relay under specific conditions. Check the configuration manual of your mail software to see how you can prevent that. Typically, you will detect this situation my going through the SMTP logs directly. If you're allowing relay from a set list of IPs, it could also be an indication that one of these machines has been compromised.