Strange observation with spamming

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I hope this list is the right forum to discuss my findings.

Somebody mailed us that he recieved 6 spam mails with a sender address from
one of our employees latey. Of course you can fake that address, so nothing
interesting up to now. But I looked into the logfiles of our mailserver and
found the following:

Feb  3 09:52:56 mail postfix/smtpd[24063]: 7D60B9096B: reject: RCPT from
p549A33B4.dip.t-dialin.net[84.154.51.180]: 554 <[email protected]>: Relay access
denied; from=<YYY@mycompany> to=<[email protected]> proto=SMTP helo=<biebl.org>

Any idea why the spammer / zombie tried to send out via our mail server?
Any idea why the spammer uses the name of our employee several times, besides
that he is dedicated in fighting spam in the ISOC?
Is there any spamware know with this behaviour?

Any idea is welcome.

If it is interesting for this list I can update you on further findings in
this case.


- -- 
Dr. Michael Schwartzkopff
MultiNET Services GmbH
Bretonischer Ring 7
85630 Grasbrunn

Tel: (+49 89) 456 911 - 0
Fax: (+49 89) 456 911 - 21
mob: (+49 174) 343 28 75

PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCC71FqndXpO3Yl5sRAmkmAJ9dOJ6C9MpZrlC2R7vUXuwqNOBcSwCgr5tw
vUqDfpWtDwfUMWSKkCAts4Q=
=RfR1
-----END PGP SIGNATURE-----
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions