When an account has been compromised, the spammer will try to send as much spam as possible though the server. This can cause a number of issues, including getting a domain or IP address blacklisted. Accounts can get compromised a number of ways, the most common of which is when the account is using a weak, insecure password.

 

There are a few ways administrators can become aware of when an account has been compromised, including by noticing the mail server spool filling up, causing both incoming and outgoing messages to be delayed. When this happens, administrators can review the Spool Dashboard or traffic reports in order to find the compromised domain and account being used to send the large amount of email.

Follow these steps to find the compromised account by reviewing the Spool Dashboard:

1. Log into SmarterMail as a system administrator.
2. Click on Manage.
3. Select Spool at the top to view the spool dashboard.
4. Look at the Top Outbound Senders section to find any anomalies in outbound deliveries. If an account has been compromised, it will likely be the first in the list with the most deliveries. (The spool dashboard updates every 20 seconds for a real-time look at the spool.)
5. Determine whether the messages are valid emails or spam. This can be done in two ways. a.) Click Spool at the top. Use the search bar to find messages sent by the suspected user account. b.) Click on the Actions menu in the spool dashboard to Move Messages sent by the user (that are currently held in the spool) to their own folder on the server. Review the messages.
6. If the messages are found to be spam, use the Delete Messages action to delete the remaining messages in the spool sent by that user. 
7. If the account is determined to be compromised, you can also temporarily disable the account, preventing future email from being sent out. Use the Disable User action to disable the user's account but still allow it to receive mail. Alternatively, you can use the Manage User option to navigate to the user's settings to change the User Status to 'Disable and don't allow mail'.
8. Look at the Top Outbound IP Addresses section to find any anomalies in outbound deliveries. Spammers may send messages through just one user account; however, they may authenticate using various IP addresses. 
9. Repeat steps 5 and 6 to determine the legitimacy of the messages and take actions against them, if necessary.
10. If an IP Address is in violation, use the Blacklist IP action to add the IP address to the STMP Blocked list. (The IP will be blocked on SMTP only.)