Did you make a correlation of smtp and other activity using
log file timestamps? Some seconds (often in the same second)
before exim logs something there should be a trace in some other
log file pointing to the hijacked service.
--
Christian Recktenwald : :
citecs GmbH : exim-users-dist@???
Unternehmensberatung fuer : voice +49 711 601 2090 : Boeblinger Strasse 189
EDV und Telekommunikation : fax +49 711 601 2092 : D-70199 Stuttgart