如今，许多电子邮件应用程序（如 Sendmail、Postfix，甚至 MS Exchange）都经过重新设计，以降低沦为‘垃圾邮件中继’的可能性。 根据我们的经验，大多数 SMTP AUTH 中继攻击都是由密码保护薄弱的用户账户被入侵引起的。一旦这些账户被发现并遭到入侵，垃圾邮件发送者便会使用该用户的凭据进行身份验证，从而获得通过该服务器进行中继的权限，进而利用该服务器发送垃圾邮件。.
Below are the easy steps to stop these spam emails quickly and identify which account(s) has been compromised.
Step1: Stop on on-hold mail queue.
Large amount of spam emails keep queueing your mail spool. What even worst is all the spam it fill up all your /var. Thus, it is always to hold the mail queue for temporary until you find out the which account has been exploited by spammer and send a large amount of emails.
Step2: Check your mail log.
Go to /var/log/maillog to have a quick look on the line with from:. You might see lots of email domain name there are not belong yo your organization. This is due to the spammer is faking the mail from:.
Step 3: Identify compromised account authenticating SMTP AUTH connection
Next, let us check those email accounts that has been exploited. Run a have cat grep sasl_username and sort it. You should see a long list of the login attempt and session for those exploited account. You can also do a quick calculation by running wc -l command to see total sessions for a particular user.
Step4: Disable the exploited email account.
Once, we have SASL_username string, which is the user account. You are advised to disabled or change the password to complex password.
Step 5: Move the mail queue or delete the spam email
Now, we have to deal with our mail queue. Easier and fastest way is to move your mail queue and do the housekeeping later. Or, you can delete those spam email using Bash script.
Step 6: Release Mail queue
Remember to release mail queue after our housekeeping process and keep on monitoring of the mail traffic.