URGENT: Our server got listed on spamhaus.org

[moniker]

User tried to send email, got bounceback:
<Tim@paragonforming.com>: host canit2.digicon.net[63.148.24.209] said: 550
5.7.1 <Tim@paragonforming.com>... Rejected: 208.44.108.226 listed at
sbl-xbl.spamhaus.org (in reply to RCPT TO command)

Went to spamhaus.org, read how to test proper HELO by emailing to helocheck@cbl.abuseat.org, got this back:
<helocheck@cbl.abuseat.org>: host mail.cbl.abuseat.org[216.168.28.54] said: 550 Your HELO name for IP address 208.44.108.226 was "group.shoptocook.com" (in reply to RCPT TO command)

According to their documentation this is correct! HELP!!

[phoenix]

That IP address isn't listed in XBL or RBL according to this page - if you are on their list then you need to contact them about being removed.

[rsharpe]

You will need to contact them and figure out how to get your server delisted. And then you may have to do it for other RBL sites.

[moniker]

Yeah, I went and delisted us from the database, but I'm still really worried as to why we appeared on there in the first place? I checked the mail queue and no noticeable increase in message activity so I don't think one of our users was spamming. I checked the server over and it doesn't appear to be compromised. Argh...