Hi All, someone is spaming through my server, how do i find that spammer, he is sending mails through some script. any help would be highly appreciated.



Return-Path:
Received: from rs25s11.datacenter.cha.cantv.net (10-128-141-4.ric2.cantv.net [10.128.141.4])
by rs26s7.mgmt.cantv.net (8.14.3/8.14.3/1.0) with ESMTP id o1PIIboZ002461
for ; Thu, 25 Feb 2010 13:48:37 -0430
X-Virus-Scanned: amavisd-new at cantv.net
Received: from free72.lime.com (vm001.lime.com [64.90.182.192] (may be forged))
by rs25s11.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id o1PIIOXG032389
for ; Thu, 25 Feb 2010 13:48:37 -0430
X-Matched-Lists: []
Received: from free72.lime.com (free72.lime.com [127.0.0.1])
by free72.lime.com (8.13.8/8.13.8) with SMTP id o1PIIO26021450
for ; Thu, 25 Feb 2010 13:18:24 -0500
Date: Thu, 25 Feb 2010 13:18:24 -0500
Message-Id:
Received: (from $munged$@$munged$)
by free72.lime.com (mini_sendmail/1.3.6 29jun2005);
Thu, 25 Feb 2010 19:18:24 MET
(sender $munged$@$munged$)
To: $munged$@$munged$
Subject: From the FMF, Federal Ministry of Finance
From: DR OKAFOR MORGAN
Reply-To: $munged$@$munged$
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
X-SPF-Scan-By: smf-spf v2.0.2 - http://smfs.sf.net/
Received-SPF: None (rs25s11.datacenter.cha.cantv.net: domain of $munged$@$munged$
does not designate permitted sender hosts)
receiver=rs25s11.datacenter.cha.cantv.net; client-ip=64.90.182.192;
envelope-from=; helo=free72.lime.com;

Chances of finding a spammer are extremely slim, it's even possible that it could by an automated agent/malware of some kind. You'd be better off spending your time locking down the server to prevent the abuse

cheers

Sounds like you're an open relay via Postfix. Worst possible scenario for you...

http://www.abuse.net/relay.html

Does the server also run Apache? Do you have a PHP script online that sends email, that may be the cause.