My network admin stopped me this morning. We are in the process of launching a new mail server for our lan. It's an nt box running MERAK Mail Server. Anyway he brought it online last Mon. The system had never been open previous to this.
He was'nt really paying attention to it, having other stuff to do. Anyway hesays it started to slow down... then really die. He's now paying attention thru netstat... this things almost dead. He brings it off-line then gets the log files out. Seems he forgot to turn off relaying.
Someone in "Czech" found it. They were using it to send over 400 msgs a minute...... there were 6000 msg's queued waiting to go when he shut it down....
5 minutes after it was shut down, this "guy" starts probing the system, trying to get back in.......
Man ... this guy had been sending mail (read spam) for 3 days............... IP's were spoofed.. Admin couldnt find him .. and deleted the logs .....arrrghhh


Oh well, lesson learned.