mistake setting or virus ?

[pamulangnet]

one of the user use webmail zimbra , but there are some odd matters that happened at receiver :

1. consignor name change
2. cheque in preference->account>primary account setting have loaded by xself. ( see attachment)



the address xxx@tes.com is account valid is while the we encircle is loaded address by xself automaticly.

step which have been done :
1. user try to remove the loaded address by xself the and try to send email again, but the name of consignor is fixed change. in re- check at account setting have re-loaded address initialy.
2. check browser regarding the virus infection conflicker via web to address following :
University of Bonn: Conficker Online Infection Indicator

result : clean /not infection

3. we check at admin console -> queue ( xxx@tes.com sending many email to unknown address )



question arise :

1. are there mistake setting at webmail user
2. is the mentioned because virus ?
3. step what do we had to do so that the case can overcome

before all we thank you for support