Increase spam/junk mails to some user accounts

Hi,

Since Friday we have been receiving a large number of junk emails to some users accounts. All affected users have changed their passwords but still receive large numbers of emails (approx 300 over the weekend).

Some of these emails appear to have been sent from one of our accounts to various support desks and has resulted in mass failure notices being delivered. Can you tell if an aacount is being used as a spam relay or similiar? I find it weird that the return path is one of our email accounts and the message has been sent to a large number of other support addresses which we have never used.

Hi. This is the qmail-send program at colima.pair.com.

I'm afraid I wasn't able to deliver your message to the following addresses.

This is a permanent error; I've given up. Sorry it didn't work out.

<support@21stcenturygames.com>:

Sorry, I couldn't find any host by that name. (#4.1.2) I'm not going to try again; this message has been in the queue too long.

--- Below this line is a copy of the message.

Return-Path: <support@imgs.ie>

Received: (qmail 33847 invoked by uid 3067); 3 Nov 2012 04:04:45 -0000

Delivered-To: soft21st-21stsoftware:com-support@21stsoftware.com

Received: (qmail 33842 invoked from network); 3 Nov 2012 04:04:45 -0000

Received: from mailwash32.pair.com (66.39.2.32)

by colima.pair.com with SMTP; 3 Nov 2012 04:04:45 -0000

Received: from localhost (localhost [127.0.0.1])

by mailwash32.pair.com (Postfix) with SMTP id 4233D10A72F

for <support@21stsoftware.com>; Sat, 3 Nov 2012 00:04:45 -0400 (EDT)

X-Virus-Check-By: mailwash32.pair.com

Received: from smtp02-forward-3.daemonmail.net (smtp02-forward-3.daemonmail.net [216.104.163.153])

by mailwash32.pair.com (Postfix) with ESMTP id F2E7410A747

for <support@21stsoftware.com>; Sat, 3 Nov 2012 00:04:44 -0400 (EDT)

Received: from mxw03.daemonmail.net (unknown [216.104.161.13])

by smtp02-forward-3.daemonmail.net (Postfix) with ESMTP id A9F1FA2BF8

for <support@21stsoftware.com>; Fri, 2 Nov 2012 21:04:44 -0700 (PDT)

Received: from localhost (localhost [127.0.0.1])

by mxw03.daemonmail.net (Postfix) with ESMTP id A2F942666B3

for <support@freejigsawpuzzles.com>; Fri, 2 Nov 2012 21:04:42 -0700 (PDT)

Received: from mxw03.daemonmail.net ([127.0.0.1])

by localhost (mxw03.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id pnWgrVIYv8Wl for <support@freejigsawpuzzles.com>;

Fri, 2 Nov 2012 21:04:39 -0700 (PDT)

Received: from supportcenteronline.com (fw.parature.com [63.150.153.4])

by mxw03.daemonmail.net (Postfix) with ESMTPS id 820352666B9

for <support@freejigsawpuzzles.com>; Fri, 2 Nov 2012 21:04:39 -0700 (PDT)

Received: from prodsvchost2-a (unknown [10.10.2.4])

by supportcenteronline.com (Postfix) with ESMTP id 6BDAB121502;

Sat, 3 Nov 2012 00:04:45 -0400 (EDT)

Reply-To: support@imgs.ie

From: "IMGS - Support" <support@imgs.ie>

To: "support@europatraveltour.com" <support@europatraveltour.com>,

"support@everydns.com" <support@everydns.com>,

"support@everystockphoto.com" <support@everystockphoto.com>,

"support@everything2.com" <support@everything2.com>,

"support@everywheremag.com" <support@everywheremag.com>,

"support@exactabet.com" <support@exactabet.com>,

"support@example.net" <support@example.net>,

"support@excellentoffers.info" <support@excellentoffers.info>,

"support@excellentrevenue.com" <support@excellentrevenue.com>,

"support@expansys-usa.com" <support@expansys-usa.com>,

"support@expansys.com" <support@expansys.com>,

"support@extjs.com" <support@extjs.com>,

"support@ezrapid.com" <support@ezrapid.com>,

"support@famspam.com" <support@famspam.com>,

"support@fastnext.com" <support@fastnext.com>,

"support@fax1.com" <support@fax1.com>,

"support@fitbit.com" <support@fitbit.com>,

"support@flex.com" <support@flex.com>,

"support@flowgram.com" <support@flowgram.com>,

"support@flowplayer.org" <support@flowplayer.org>,

"support@fmeobjects.com" <support@fmeobjects.com>,

"support@fortunecity.com" <support@fortunecity.com>,

"support@franson.biz" <support@franson.biz>,

"support@franson.com" <support@franson.com>,

"support@freejigsawpuzzles.com" <support@freejigsawpuzzles.com>,

"support@freepolls.com" <support@freepolls.com>,

"support@freshbooks.com" <support@freshbooks.com>,

"support@fugawi.com" <support@fugawi.com>,

"support@fulltiltpoker.com" <support@fulltiltpoker.com>,

"support@gandi.net" <support@gandi.net>,

"support@gavick.com" <support@gavick.com>,

"support@gaymanicus.com" <support@gaymanicus.com>,

"support@gci.net" <support@gci.net>,

"support@gensmarts.com" <support@gensmarts.com>,

"support@geometricinformatics.com" <support@geometricinformatics.com>,

"support@getgambit.com" <support@getgambit.com>,

"support@getglue.com" <support@getglue.com>,

"support@getsatisfaction.com" <support@getsatisfaction.com>,

"support@gettyimages.com" <support@gettyimages.com>,

"support@giganews.com" <support@giganews.com>,

"support@gigaom.com" <support@gigaom.com>,

"support@gigya-inc.com" <support@gigya-inc.com>,

"support@gisteq.com" <support@gisteq.com>,

"support@github.com" <support@github.com>,

"support@goanimate.com" <support@goanimate.com>,

"support@godaddy.com" <support@godaddy.com>

Message-ID: <UXjSnM0paQQA/mVs4tLgsf7yOgg3sYm8br83Tgmlsgw=@notify.parature.com>

Date: Sat, 03 Nov 2012 00:04:40 -0400

Subject: Ticket #9139-4567719: Provided Info (MAY THE LORD BLESS YOU AS YOU REACH ME)

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----B1B93051140046488B0620BC1726BBAA"

------B1B93051140046488B0620BC1726BBAA

Content-type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable