How to find the source of spam

[armitage318]

Hi,
at present I have around 20000 email in postfix queue.
I'm using zcs-7.1.0_GA
How can I find the authenticated user that as been hacked?

And how can I mass-remove messages from a specific sender?
Thank you very much

[alessandro.motta]

Hi,
i think this command could help you:

grep sasl /var/log/maillog

you should be able to see which user sends so many emails.
Also you can see the client ip address near the username, if it's a strange ip it'll be definitely the cause of the problem.

To mass-remove messages from a specific user you can go into the admin console, under "Queues", and select the server.
Now right click the sender of the spam messages and select "Delete".

Regards

[armitage318]

Hi Alessandro,
thank you very much!
Problem solved.