OT: Need MS Exchange help

[Ed]

On Wed, Apr 2, 2014 at 11:34 AM, George Toft <george at georgetoft.com> wrote:
> Pretty far off topic, but there are lots of smart people here :)
>
> I have a client that has an Exchange server that also is an open relay as
> determined by http://www.mailradar.com/openrelay/.  They route all their
> incoming/outgoing email through mxlogic for anti-virus/phishing removal and
> about 5 days ago, they started sending out 2000+ phishing emails per hour.
> Needless to say, mxlogic shut down their outgoing email.  I did an open
> relay test (see above) and got back 3 failures out of 18 tests.
>
> This is impacting their business and they need help NOW.  Anyone care to
> help out?  Anyone know someone that can help?  This is not a gratis gig -
> they will pay.
>
> --
> Regards,
>
> George Toft
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss

1) Does the spam come from known_good addresses in your email system?
2) are there any webservers or other services that route email through that box?
3) Is the Exchange box on the Internet? the MX record? that's always a mistake.

Exchange might not be your problem, but typically I put a postfix
server in front of Exchange for access control and spam/virus
filtering etc.