A large number of transit messages

[JeckDigger]

The mail server is behind a NAT on the LAN port forwarding on it 80, 143, 25. There is a large number of transit messages. Tell me how to fix it.

Statistics for the day:

Host/Domain Summary: Message Delivery (top 50)
sent cnt bytes defers avg dly max dly host/domain
-------- ------- ------- ------- ------- -----------
1002k 5355m 104113 39.1 s 3.9 h yahoo.com.tw
5333 28669k 439 38.9 s 2.5 h kimo.com
832 4474k 33 38.8 s 45.6 m ymail.com
733 1542k 22 14.8 s 36.4 m seed.net.tw
282 1502k 40 35.8 s 2.0 h yahoo.com.hk
172 413523 166 14.0 s 2.0 h msa.hinet.net
152 332892 49 18.2 s 1.3 h hotmail.com
138 297244 14 17.5 s 2.3 h mail2000.com.tw

[ZMike]

Grep /var/log/zimbra.log for deferred messages, find account they're sent from, block it, clean the queue. Somebody had a weak pass probably. Check $ZIMBRA_PATH/log/audit.log for failed login attempts.

Until done, you'd better close SMTP port, 1 million spam messages is enough for the day.