Exchange problem

[Dalehead]

Hey guys

Hoping someone there who's knowledgeable in Exchange can help me out here.

I have a couple of users who are getting the following email

Your message did not reach some or all of the intended recipients.

Subject: Your Account is Suspended For Security Reasons

Sent: 05/07/2005 14:14

The following recipient(s) could not be reached:

jerry@domain.com on 05/07/2005 14:20

The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.

<domain.com #5.1.1>


Where it says domain, i've changed that from our company domain, but the point being that the jerry@ above is replicated lots each day with random names.

Now only some of my users are getting this. Has their email address been picked up somewhere and is being used externally for spamming addresses at us (i.e. originating elsewhere), or could they have a virus somewhere thats causing these to be sent?

I'm out of options, the email server itself is clean of virus's.

Thanks

[cahonis]

Dale, this sounds alot like spoofing m8. From what u have said ur users are getting these emails from external sources when they haven't attempted to send an email to the specified recipient?

If that is the case then a bunch of ur email addresses have gotten onto some Spam list or other and are being used in the header information of SPAM emails, the recipient of which does not exist, hence the return email informing the user (urs) in the faked header.
Just ignore them. We get quite alot of this and it's far too much effort & time to trace it back. If you wanted you could log it with SpamCop, but I'm sure u have better ways of spending ur time :)