Sounds like their password might have been stolen and is now being used by a spam bot, have you tried forcing that user to change their password?
If you don't think that is the issue could you post some log entries showing these mails "to unknown address every one minutes from one user"? Try looking in /var/log/zimbra.log for this. |