Hi Nick, thanks for help.
yes, denny@rdpomss.com is users, so I have delete and recreate the user and change the password stronger, reinstall os client and disable android access.
I have 3 office witch 2 of them in the external network (access by internet) an so many user access by smartphone, so I can not use trusted network concept
for encryption type I set none.

my friend said that I have add reject_sender_login_mismatch rule, so the spam can not send email with different account
for this case I have test my smtp with this configuration


I can send email use unknown email but with real account and password.





I have try googling for add reject_sender_login_mismatch rule postfix, but I am not sure about the right script.

Thanks.

I have check /var/log/message-20150809 but find nothing.
when I recheck /var/log/maillog-20150809 the size very big (1,1 GB for a week)

and I find some unknown email log


my smtp server have been SMTP Authentication Enabled, I have test without real username or password the email can not be sending.

any idea?

So far, I have delete the local account and recreate with the new password, reinstall Client OS, blacklist some unknown email sender from mailer-daemon report and block some ip (101.78.174.62 etc) with iptable. I think the broadcast messages has been stopped and I will check it for some day to make sure.
but I am not sure where is the spam source come from. I am not check the messages log yet, so I'll do it tomorrow.

Thanks for help Nick.

Nick Howitt wrote:

.. and the same question. Do you hand a dynamic ip? If so, are you sending mail directly or relaying it via your ISP?

I have the same issue and I think my zarafa have been spamming

the similar line exist more than 2000 line at the maillog

Please Help.

Thanks.