Phantom Emailer?

[ADAM]

I am running Windows 2000 Pro with Exchange 2000. I have
one user who keeps getting undeliverable emails in her
inbox that were sent from her, often at a time when the
office is closed, to a user who was fired and uninstalled
from our systems over a year ago! I have checked her
delegates and no one is listed and I've verified the her
emails are not being forwarded to another account. I have
run Ad-aware and scanned for viruses on both our exchange
server and on her local machine. Does anyone know what is
going on here and how to fix it?

Below I have included a copy of the undeleiverable email
that she keeps recieving. It is always to the same exact
user but at differing times.

"Your message did not reach some or all of the intended
recipients.

Subject: Notify about using the e-mail account.
Sent: 4/11/2004 11:07 PM

The following recipient(s) could not be reached:

(e-mail address removed) on 4/11/2004 6:54 PM
The e-mail account does not exist at the
organization this message was sent to. Check the e-mail
address, or contact the recipient directly to find out the
correct address."

Thanks for the help!

 

[Lanwench [MVP - Exchange]]

Look at the subject line - this seems to be the result of Bagle virus or a
variant. Like most viruses, this one is spoofing the sender - so the
"purported sender" is getting the NDR. The original message probably didn't
originate from your network, but I have to ask, do you have good AV
software? Exchange-aware software like ScanMail or Antigen,
workstation-level AV, file-server AV, etc?

 

[Guest]

We are running Norton Anti-Virus Corporate Edition.