My maillogs are showing a lot of messages originating from <> going to different addressed on the internet many (most?) of which are timing out, denying connections, bouncing, etc. For example:

Apr 29 04:06:32 cork postfix/nqmgr[23433]: 9FDB2406C9: from=<>, size=19430, nrcpt=1 (queue active)
Apr 29 04:07:44 cork postfix/nqmgr[23433]: 9FDB2406C9: to=<accordsyst.com@hbweite.com>, relay=none, delay=196746, status=deferred (connect to mail.hbweite.com[220.194.253.78]: Connection timed out)

Does anyone know of a way to determine where these messages are originating from? We're not an open relay so that shouldn't be the case; and there's no indication of any security problems. I suppose it's possible that there are compromised machines on our campus that are relaying mail through our mail server. But does is there a way to verify their origin?

Thanks.

grep the log for the queue id:The first line should look something like and show the source IP of the connection.