1 (edited by fletcher 2021-01-06 08:02:49)

Topic: User compromised, if account enabled spam continues.

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):
1.2.1 MARIADB edition.

- Deployed with iRedMail Easy or the downloadable installer?
downloadable installer
- Linux/BSD distribution name and version: Ubuntu 18.04.5 LTS
- Store mail accounts in which backend: MySQL
- Web server (Apache or Nginx): NGINX
- Manage mail accounts with iRedAdmin-Pro? YES
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Thanks in advance.
The logs really show nothing except an authorized user sending tons and tons of mail to a bunch of yahoo accounts. I had the user turn off computer and phone. If the account is enabled, her account spams to yahoo users about sex sites. If I disable her account, everything works well. Changed password on her account twice. The spam seems to be generating when the account is enabled. Within 2 seconds of saving changes to enable account, 100 from taylor2@ start.

Here is the log from the moment after enabling her account to disabling it: (swapped real domain)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8MTp3MVzzWlXf: from=<taylor2@domain.com>, size=4715, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8fzd3JmXzWkbK: from=<taylor2@domain.com>, size=4669, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DZJ3KG8zWjWw: from=<taylor2@domain.com>, size=4678, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D873q3NSrzWlKP: from=<taylor2@domain.com>, size=4731, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8g523Z4WzWljq: from=<taylor2@domain.com>, size=4712, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8rMm3P3TzWlBZ: from=<taylor2@domain.com>, size=4698, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DZH3WSMzWm4Z: from=<taylor2@domain.com>, size=4714, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9NKy3QlvzWm89: from=<mnasioula@domain.com>, size=21419, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8dVN3KkWzWfZL: from=<taylor2@domain.com>, size=4709, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b753jJvzWjgG: from=<taylor2@domain.com>, size=4699, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DZJ3MzrzWm4b: from=<taylor2@domain.com>, size=4676, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DWV3VvKzWm3W: from=<taylor2@domain.com>, size=4709, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8fzd3Gq6zWkQj: from=<taylor2@domain.com>, size=4663, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8rNR3hHQzWlFn: from=<taylor2@domain.com>, size=4692, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8dWX3VDwzWlfV: from=<taylor2@domain.com>, size=4770, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8dW43RJmzWlfY: from=<taylor2@domain.com>, size=4680, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7gmR3ZvzzWkkK: from=<taylor2@domain.com>, size=4715, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DVt3J7LzWm38: from=<taylor2@domain.com>, size=4810, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5p0z4tzWjfr: from=<taylor2@domain.com>, size=5189, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DXl12yLzWm3x: from=<taylor2@domain.com>, size=4720, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b9V148DzWjkx: from=<taylor2@domain.com>, size=4726, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8dW916K0zWlfb: from=<taylor2@domain.com>, size=4691, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DX41LrDzWm3c: from=<taylor2@domain.com>, size=4682, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DWK1MfRzWm3J: from=<taylor2@domain.com>, size=4808, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5p17zKzWjfv: from=<taylor2@domain.com>, size=4730, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DWK1NB7zWm3P: from=<taylor2@domain.com>, size=4800, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7qZr1N85zWkq6: from=<taylor2@domain.com>, size=4854, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5c1MwDzWjfh: from=<taylor2@domain.com>, size=4783, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DZC1G47zWm4W: from=<taylor2@domain.com>, size=4707, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7qZr1MdSzWknK: from=<taylor2@domain.com>, size=4862, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5T1DfBzWjfX: from=<taylor2@domain.com>, size=4781, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DZc1Gv6zWm4l: from=<taylor2@domain.com>, size=4702, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8dWx1FlszWlfj: from=<taylor2@domain.com>, size=4671, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b9V10dKzWjh7: from=<taylor2@domain.com>, size=4722, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5T1BRjzWjfW: from=<taylor2@domain.com>, size=4779, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8g4z0xMkzWljt: from=<taylor2@domain.com>, size=4721, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b7T1481zWjgL: from=<taylor2@domain.com>, size=5164, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8g5B10CVzWljw: from=<taylor2@domain.com>, size=4789, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5p170rzWjft: from=<taylor2@domain.com>, size=4724, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b9B16BZzWjkq: from=<taylor2@domain.com>, size=4681, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5p12qhzWjfs: from=<taylor2@domain.com>, size=5179, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8rPj1lCMzWlJ3: from=<taylor2@domain.com>, size=4657, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8rLt1dYVzWl6M: from=<taylor2@domain.com>, size=4783, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DVf1XPmzWm2x: from=<taylor2@domain.com>, size=4684, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8rNN1bMWzWlF0: from=<taylor2@domain.com>, size=4695, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DX41R5gzWm3g: from=<taylor2@domain.com>, size=4692, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8rNN1YhszWlDd: from=<taylor2@domain.com>, size=4695, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b5h1jzrzWjfj: from=<taylor2@domain.com>, size=5173, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8dVr1hBCzWlfT: from=<taylor2@domain.com>, size=4705, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b6s1PCYzWjgF: from=<taylor2@domain.com>, size=4805, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8g2l1gjdzWljZ: from=<taylor2@domain.com>, size=4704, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DYx1m6ZzWm4B: from=<taylor2@domain.com>, size=4785, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DVf1PRszWm2w: from=<taylor2@domain.com>, size=4684, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D7b6s1Xs0zWjgH: from=<taylor2@domain.com>, size=4805, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8g0x1mgMzWljJ: from=<taylor2@domain.com>, size=4702, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8g0x1mMBzWljH: from=<taylor2@domain.com>, size=4712, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D9DZc1PLqzWm4m: from=<taylor2@domain.com>, size=4706, nrcpt=1 (queue active)
Jan  5 23:23:15 mailsrv postfix/qmgr[2461]: 4D8dWp1qcKzWlfd: from=<taylor2@domain.com>, size=4985, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZC1j7qzWm4H: from=<taylor2@domain.com>, size=4687, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8rPj1drQzWlHq: from=<taylor2@domain.com>, size=4655, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b951YZ3zWjh5: from=<taylor2@domain.com>, size=4714, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b5Z1Rg7zWjfb: from=<taylor2@domain.com>, size=4714, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8g3648XSzWljl: from=<taylor2@domain.com>, size=4673, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8g523lXHzWljx: from=<taylor2@domain.com>, size=4710, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dTS3ywtzWldv: from=<taylor2@domain.com>, size=4669, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D88cm3y8xzWlLZ: from=<taylor2@domain.com>, size=4793, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b6P3z1SzWjgB: from=<taylor2@domain.com>, size=4692, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b753txJzWjgM: from=<taylor2@domain.com>, size=4705, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8rNN433QzWlBr: from=<taylor2@domain.com>, size=4697, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZN3s5xzWm4c: from=<taylor2@domain.com>, size=4715, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DWy447SzWm3Z: from=<taylor2@domain.com>, size=4740, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8g3640tXzWljk: from=<taylor2@domain.com>, size=4667, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8rNR3k84zWlFp: from=<taylor2@domain.com>, size=4696, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8g1S3xQczWljR: from=<taylor2@domain.com>, size=4686, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dTS3mp1zWldy: from=<taylor2@domain.com>, size=4677, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8k5M439yzWkm4: from=<taylor2@domain.com>, size=29745, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZd47rzzWm4q: from=<taylor2@domain.com>, size=4694, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DWy42clzWm3Y: from=<taylor2@domain.com>, size=4736, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9Dbf3qJXzWm51: from=<taylor2@domain.com>, size=4735, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b8Y5LtNzWjgy: from=<taylor2@domain.com>, size=4738, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b5p590nzWjfx: from=<taylor2@domain.com>, size=4638, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dW357NBzWlfW: from=<taylor2@domain.com>, size=4685, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DYS5HD6zWm49: from=<taylor2@domain.com>, size=4717, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18553]: Trusted TLS connection established to mx-aol.mail.gm0.yahoodns.net[67.195.204.80]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dW35CbjzWlfc: from=<taylor2@domain.com>, size=4671, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dX85CCRzWlfL: from=<taylor2@domain.com>, size=4765, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b975KMyzWjh8: from=<taylor2@domain.com>, size=4764, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZ35X8bzWjXJ: from=<taylor2@domain.com>, size=4680, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b7w5J33zWjgt: from=<taylor2@domain.com>, size=4791, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8LgT5RV7zWkRd: from=<taylor2@domain.com>, size=4703, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8g085CrnzWlj8: from=<taylor2@domain.com>, size=4690, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7br85NMjzWjQx: from=<taylor2@domain.com>, size=4722, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9Db85DKzzWm4y: from=<taylor2@domain.com>, size=4672, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8g2r5RkrzWljY: from=<taylor2@domain.com>, size=47459, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18553]: 4D8rNN1YhszWlDd: host mx-aol.mail.gm0.yahoodns.net[67.195.204.80] said: 421 4.7.0 [TSS04] Messages from xxx.xxx.xxx.xxx temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.verizonmedia.com/error-codes (in reply to MAIL FROM command)
Jan  5 23:23:16 mailsrv postfix/smtp[18553]: 4D8rNN1YhszWlDd: lost connection with mx-aol.mail.gm0.yahoodns.net[67.195.204.80] while sending RCPT TO
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZF5QL3zWm4Y: from=<taylor2@domain.com>, size=4685, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dVd5WGszWlfM: from=<taylor2@domain.com>, size=4985, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7mQV5BYKzWknr: from=<taylor2@domain.com>, size=4860, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8rNp5JtCzWlFm: from=<taylor2@domain.com>, size=4695, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b6M5WGLzWjgC: from=<taylor2@domain.com>, size=4658, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZF5MWfzWm4X: from=<taylor2@domain.com>, size=4689, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dX85FmMzWlfX: from=<taylor2@domain.com>, size=4755, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dRN5FKMzWkVH: from=<taylor2@domain.com>, size=4688, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8rN457tWzWlD1: from=<taylor2@domain.com>, size=4699, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZZ5ThJzWm4f: from=<taylor2@domain.com>, size=4733, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9Db85B7lzWm40: from=<taylor2@domain.com>, size=4672, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DWV5TLZzWm3S: from=<taylor2@domain.com>, size=4718, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b8G5GttzWjgm: from=<taylor2@domain.com>, size=4700, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b8Y5PRNzWjh1: from=<taylor2@domain.com>, size=4720, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dWK5WZbzWlff: from=<taylor2@domain.com>, size=4705, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18544]: Trusted TLS connection established to mx-eu.mail.am0.yahoodns.net[188.125.72.74]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dTh57QJzWlf5: from=<taylor2@domain.com>, size=4674, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18545]: Trusted TLS connection established to mx-eu.mail.am0.yahoodns.net[188.125.72.73]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b8T5J9tzWjgs: from=<taylor2@domain.com>, size=4708, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b7F59dYzWjg6: from=<taylor2@domain.com>, size=5173, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7hr55NcHzWkk7: from=<taylor2@domain.com>, size=4710, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7br85QMpzWjSX: from=<taylor2@domain.com>, size=4722, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18546]: Trusted TLS connection established to mx-eu.mail.am0.yahoodns.net[188.125.72.74]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b5r56vvzWjg1: from=<taylor2@domain.com>, size=4706, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b975N2JzWjkp: from=<taylor2@domain.com>, size=4756, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9Db85MrYzWm50: from=<taylor2@domain.com>, size=4678, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18547]: Trusted TLS connection established to mx-eu.mail.am0.yahoodns.net[188.125.72.73]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b5n5KYnzWjfp: from=<taylor2@domain.com>, size=4654, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8dTz5BCqzWlfD: from=<taylor2@domain.com>, size=4784, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D81b05KCrzWjl3: from=<taylor2@domain.com>, size=4944, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18548]: Trusted TLS connection established to mx-eu.mail.am0.yahoodns.net[188.125.72.74]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DVs5XY1zWm2y: from=<taylor2@domain.com>, size=47559, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8lfX5r1xzWlvg: from=<taylor2@domain.com>, size=29954, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DWZ5zYwzWm3V: from=<taylor2@domain.com>, size=4686, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DVK5tSlzWlxx: from=<taylor2@domain.com>, size=47492, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8lh95f5SzWlvp: from=<taylor2@domain.com>, size=4724, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18549]: Trusted TLS connection established to mx-eu.mail.am0.yahoodns.net[188.125.72.73]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b9Q5mzBzWjky: from=<taylor2@domain.com>, size=4688, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8g375q8zzWljg: from=<taylor2@domain.com>, size=4708, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DVn5rZwzWm34: from=<taylor2@domain.com>, size=4688, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DZZ5dFNzWm4j: from=<taylor2@domain.com>, size=4739, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DWV5khDzWm3f: from=<taylor2@domain.com>, size=4720, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b9G61pNzWjkm: from=<taylor2@domain.com>, size=4696, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18550]: Trusted TLS connection established to mx-eu.mail.am0.yahoodns.net[188.125.72.74]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b9V5h5nzWjl9: from=<taylor2@domain.com>, size=4676, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b7Y5f92zWjgY: from=<taylor2@domain.com>, size=5162, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8lh95nyMzWlvl: from=<taylor2@domain.com>, size=4726, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D8ZM05mrkzWlZC: from=<taylor2@domain.com>, size=34054, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18560]: Trusted TLS connection established to mx-aol.mail.gm0.yahoodns.net[67.195.204.75]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b7Q5gwzzWjgT: from=<taylor2@domain.com>, size=4687, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D9DWZ5xyyzWm1q: from=<taylor2@domain.com>, size=4690, nrcpt=1 (queue active)
Jan  5 23:23:16 mailsrv postfix/smtp[18555]: Trusted TLS connection established to mta5.am0.yahoodns.net[98.136.96.77]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jan  5 23:23:16 mailsrv postfix/qmgr[2461]: 4D7b7Y5cpvzWjgN: from=<taylor2@domain.com>, size=5152, nrcpt=1 (queue active)

2

Re: User compromised, if account enabled spam continues.

Solved. The hack was one issue. Once solved, the users deferred mail, as shown in the logs, kept sending and sending because postfix had already accepted mail from an authorized user. Any email which has been refused by another email server tries for five or six days.


SO after fixing any hacked password, check your mail queues for deferred emails and delete them.