[d33psky]

One of my Exchange 2003 users is getting "Undelivered Mail Returned to Sender" emails from emails that she never sent. Is there a way to track/and or prevent this from happening?

Here is the header, my user is hnabers.

Received: from vtjzixvpm1.ventech.com (ZixVPM [127.0.0.1])
    by Outbound.ventech.com (Proprietary) with ESMTP id 9A35F4C18A
    for <newsletter@ticketsnow.com>; Wed, 18 Nov 2009 06:50:27 -0600 (CST)
Received: from jbsrexch01.j*******.com (uslec-63-243-115-166.cust.uslec.net [63.243.115.166])
    by vtjzixvpm1.ventech.com (Proprietary) with ESMTP id DC9823F481C
    for <newsletter@ticketsnow.com>; Wed, 18 Nov 2009 06:50:26 -0600 (CST)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----_=_NextPart_001_01CA684D.B2A42D09"
X-MimeOLE: Produced By Microsoft Exchange V6.5
Subject: Out of Office AutoReply: Ticket Alert Heather . Lady Gaga goes solo starting this November!
Date: Wed, 18 Nov 2009 07:50:25 -0500
Message-ID: <2D4C6573E8E30E44A4130DE11638206CEA2264@jbsrexch01.jaxbank.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Ticket Alert Heather . Lady Gaga goes solo starting this November!
Thread-Index: AcpoTbKJ0Ial8kPtRxupRRgxE1EOBQAAAAbm
From: "Nabers, Heather" <hnabers@*******.com>
To: "TicketsNow" <newsletter@ticketsnow.com>

Any idea whats going on here?

[cwwozniak]

It is most likely that spammers got a hold of the person's e-mail address one way or another. They troll web sites, including this one, looking for e-mail addresses (like the one in your post) to add to their collection. They are then using that address as the sender address in the header to send spam to others.

[d33psky]

Thanks for your reply. That's basically what I've told my users in the past. I suppose I should remove the full email address from this thread.

So basically it is out of my hands at this point?

[cwwozniak]

Originally Posted by d33psky

So basically it is out of my hands at this point?

Unfortunately that is the case. If you try to filter out the bounce messages for the spam with the forged headers, you would also probably filter out any real bounce messages.

[d33psky]

Yeah, that's a good point. My user's just going to have to deal with it, haha. Thanks for your help.