mail spam help

[gromsp]

(08-17-2012 01:35 AM)joximu Wrote:  well - then you may have a look some lines before this entry to see if it was a connection from "outer space" or localhost.

And then - if localhost (or local ip) - you may need to find out which website...

you also may have a look at the content of the mail - in /var/spool/postfix/deferred/c/.... number...
or "defer" instead of deferred... I don't know by heart.. (one is content the other place stores the headers)

Sometimes the content also helps to find the origin....

/J

Thanks for the help
the problem is solved.
During server testing it was open relay for a short time and that spam mail was only in mailQ. Flushing mailq resoved problem. Youre post was very helpful thanks once more