I should have included headers from the spam email. They are below.
2008/1/24, Zbigniew Szalbot <zszalbot@???>:
> Hello,
>
> I'd like to ask for help in interpreting the below log. Do I have a
> problem on my machine? That is, is someone sending emails really from
> localhost?
>
> 2008-01-24 12:40:01 1JI0R7-000L99-Ps <=
> lcn-kit_intra-request@??? H=localhost (lists.lc-words.com)
> [127.0.0.1] P=esmtp S=8600
> id=20080124131942.13769.qmail@???
> 2008-01-24 12:40:02 1JI0R7-000L99-Ps =>
> /var/spool/virtual/lists.lc-words.com/postmaster/Maildir
> <postmaster@???> R=virtual_domains T=virtual_delivery
> DT=0s
> 2008-01-24 12:40:02 1JI0R7-000L99-Ps Completed
>
> There should be no localhost sender on this machine so if there is
> one, then I do have a script somewhere on the HD!
>
> Many thanks for your help!
>
> Zbigniew Szalbot
>
Return-path: <lcn-kit_intra-request@???>
Envelope-to: postmaster@???
Received: from localhost ([127.0.0.1] helo=lists.lc-words.com)
by lists.lc-words.com with esmtp (Exim 4.69 (FreeBSD))
(envelope-from <lcn-kit_intra-request@???>)
id 1JI0R7-000L99-Ps
for postmaster@???; Thu, 24 Jan 2008 12:40:01 +0100
Received: from localhost.lists.lc-words.com [127.0.0.1]
by lists.lc-words.com with POP3 (fetchmail-6.3.8)
for <postmaster@???> (single-drop); Thu, 24 Jan 2008
12:40:01 +0100 (CET)
Received: from host184-68-static.4-79-b.business.telecomitalia.it
([79.4.68.184])
by lists.lc-words.com with smtp (Exim 4.69 (FreeBSD))
(envelope-from <lcn-kit_intra-request@???>)
id 1JI091-000Kno-GN
for mail@???; Thu, 24 Jan 2008 12:21:24 +0100
Content-Return: allowed
Thank you again!
Zbigniew Szalbot
