"Steve" HIDDEN@wavedirect.net> wrote:
>
>None of these users or IP's exist on my network.   Anyone know how he's able to do this?  Is this a known bug (I do have an older version of Surgemail 

Here is more info Its stopped now.  I think I found an account that was compromised but why are the logs making absolutely no reference to it? 

Received: from Debian-exim by obfuscated2 with spam-scanned (Exim 4.71)
(envelope-from HIDDEN@ldo13@bolivia.com>)
id 1RbWKe-0004mD-G5
forHIDDEN@@smtp.example; Fri, 16 Dec 2011 06:52:18 -0500
Received: from surgemail.wavedirect.net ([mymailserverip]:59362 helo=wavedirect.net)
by obfuscated2 with esmtp (Exim 4.71)
(envelope-from HIDDEN@ldo13@bolivia.com>)
id 1RbWKe-0004lu-BU
forHIDDEN@@smtp.example; Fri, 16 Dec 2011 06:52:08 -0500
Received: from User (unverified [197.255.164.39]) 
by wavedirect.net (SurgeMail 4.0u4) with ESMTP id 1960812-1723769 
for multiple; Fri, 16 Dec 2011 06:28:18 -0500
Reply-To: HIDDEN@ldo@bolivia.com>
From: "Jos� Valdo"HIDDEN@ldo13@bolivia.com>
Subject: Aten��o: Benefici�rio 
Date: Fri, 16 Dec 2011 12:25:43 +0100
MIME-Version: 1.0
charset="Windows-1251"