Logwatch is showing that someone is trying to spam our email server by looking for common names....bob@x.com, bill@x.com, etc...

In my maillog file, I can see it happening, but the log doesn't record the sender. I would like to figure out who is doing this so I can block them.

maillog just shows something like this for every failed attempt:

Jan 15 04:18:29 mail sendmail[26582]: h0F9GkX6026582: <jane@x.com>... User unknown

Thanks,
M

if "grep /etc/syslog.conf -e "maillog" doesn't show up as
mail.*<tab><tab>/var/log/maillog
try to insert a line line that and kill -HUP syslogd to restart it.
This ensures maillog contains everything sendmail spits out.
If that doesn't work but spam get's through, have a look at the headers (shift+h in pine).

Also if "grep /etc/sendmail.cf -e vrfy" doesn't show up at least as
O PrivacyOptions=novrfy
if you're using linuxconf
make a file called /etc/mail/mailconf/stdoptions.cf and add:
$(VERIFY)O PrivacyOptions=authwarnings,novrfy,noxpn
now run "mailconf --generatecf"
else
add a line to /etc/mail/sendmail.mc:
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn')dnl
and run "m4 /etc/mail/sendmail.mc > /etc/sendmail.cf"

This will disable remote users to verify local addresses.