Suspicious emails from the server

[anton.aleksandrov]

Hello,
Sorry for nagging again about similar issue (http://www.zimbra.com/forums/adminis...-new-post.html)

I am now inspecting table "mta" of zimbra_logger database. How possible that sender is "dommenx@hotmail.com", from IP is "127.0.0.1" and destination is quite reasonable remote server. Does it mean that email originates from us? Could that be "bounce back" email? How (using which field, key) can I retrieve email from raw_logs table?

I would appreciate any help or suggestion.

Regards,
Anton.