>From Ken
>There are several ways. My guess would be an old vulnerable formmail CGI
>script or something similar. Look at the maillog and look at the time the
>first one started to go out. grep the access_log for that time and see if a
>CGI script was being accessed. Or, it's possible another type of vulnerable
>script allowed the spammer to place their own script. Also, if you allow
>your customers SMTP, it's possible one of your customers is the cause. They
>could have a trojan using your SMTP AUTH.
I did'nt get your email or my own!!!, but when I looked for it on the ml on
bluequartz I found it!
But I follow you advise and found the script that was the case.... Thanks.
--
Thomas Jensen