So I'm operating an Ubuntu VPS that uses postfix for sending outgoing mail. I have several email addresses attached to the domain that it hosted on the VPS, one of them is say firstname.lastname@example.org. The owner of this email address has two personal computers and no more and they've up until now been using Thunderbird to access the email address.
A couple of days ago the inbox for email@example.com started getting slammed with hundreds and hundreds of bouncebacks an hour, the owner of firstname.lastname@example.org deleted her Thunderbird entries for those email accounts yesterday to no avail.
Both computers were shut down last night but the address was still receiving bouncebacks. Now initially I thought that because neither computer that had had the account on was turned on, this could be bounceback spam. On closer inspection of the email however, I can see some of them contain lines like:
<email@example.com>: delivery temporarily suspended: host gateway-f1.isp.att.net[18.104.22.168] refused to talk to me: 550-XX.XX.XX.XX blocked by ldap:ou=rblmx,dc=att,dc=net 550 Error - Blocked for abuse. See http://att.net/blocks
Where XX.XX.XX.XX is the IP Address of our VPN. This makes me think that it's something wrong with the postfix server (as well most likely as an infection on the computers. A full clamscan produced the following:
/var/qmail/mailnames/DOMAIN.COM/USER/Maildir/.Spam/cur/1366042516.M831269P7021V0000000000000025I0000000003C08ED0.VPS-DOMAIN.COM,S=152011:2,: Email.Trojan-432 FOUND /usr/share/MailScanner/MailScanner/MessageBatch.pm: Eicar-Test-Signature-1 FOUND
Any ideas how I can track down the issue/solve the problem?