Estimados, queria molestarles el dia de hoy mis usuarios dejaron de enviar correos a hotmail.
Revice y mi ip esta listado en listas negras.
Revisando el log del mail veo que mi servidor esta enviando muchos correos, demasiados diria yo.
Veo que envia a usuarios que no conocemos y lo que quiero identificar es saber con que usuario es el que estan enviando.
Ya en en el log veo aquien envia pero no atravez de que usaurio lo estan haciendo, para ver si es que algun spamer encontro la clave del usuario y lo esta usando para envia correo.
Uso sendmail con MailScanner en centos 5.3.
En el archivo acces del mail solo tengo pueso la ip de mir red, entonces no creo que este hecho open relay

En e log del mail tebgo algo como esto
[root@mail ~]# tail -f /var/log/maillog
Feb 9 23:34:24 mail sendmail[25472]: r19NoxBk019805: to=, delay=04:43:18, xdelay=00:00:01, mailer=esmtp, pri=1591337, relay=aspmx.l.google.com. [74.125.137.27], dsn=2.0.0, stat=Sent (OK 1360469609 n30si38657168yhc.6 - gsmtp)
Feb 9 23:34:25 mail sendmail[25472]: r19NoxBk019805: to=, delay=04:43:19, xdelay=00:00:01, mailer=esmtp, pri=1591337, relay=mx.quartz.synacor.com. [205.169.121.11], dsn=4.0.0, stat=Deferred: 421 4.7.0 [C3] Too much spam.
Feb 9 23:34:27 mail sendmail[25472]: r19NoxBk019805: to=, delay=04:43:21, xdelay=00:00:02, mailer=esmtp, pri=1591337, relay=mta6.am0.yahoodns.net. [98.136.217.202], dsn=5.0.0, stat=Service unavailable
Feb 9 23:34:29 mail sendmail[25472]: r19NoxBk019805: to=, delay=04:43:23, xdelay=00:00:02, mailer=esmtp, pri=1591337, relay=mx2.sbcglobal.am0.yahoodns.net. [98.138.206.39], dsn=2.0.0, stat=Sent (ok dirdel)
Feb 9 23:34:35 mail sendmail[25472]: r19NoxBk019805: to=,,,,,,,,,,,,,, delay=04:43:29, xdelay=00:00:06, mailer=esmtp, pri=1591337, relay=mta6.am0.yahoodns.net. [98.136.217.202], dsn=2.0.0, stat=Sent (ok dirdel 10/4)
Feb 9 23:34:35 mail sendmail[25472]: r19NoxBk019805: r1A4BSbM025472: sender notify: Warning: could not send message for past 4 hours
Feb 9 23:34:35 mail sendmail[25472]: STARTTLS=client, relay=aspmx.l.google.com., version=TLSv1/SSLv3, verify=FAIL, cipher=RC4-SHA, bits=128/128
Feb 9 23:34:39 mail sendmail[25472]: r1A4BSbM025472: to=, delay=00:00:04, xdelay=00:00:04, mailer=esmtp, pri=33018, relay=aspmx.l.google.com. [74.125.137.27], dsn=5.1.1, stat=User unknown
Feb 9 23:34:39 mail sendmail[25472]: r1A4BSbM025472: r1A4BSbN025472: return to sender: User unknown
Feb 9 23:34:39 mail sendmail[25472]: r1A4BSbN025472: to=fernandos, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=34042, dsn=2.0.0, stat=Sent
Feb 9 23:34:40 mail sendmail[25472]: r19K40sb008469: to=,,,,, delay=08:30:33, xdelay=00:00:00, mailer=esmtp, pri=1592224, relay=mailin-02.mx.aol.com., dsn=4.0.0, stat=Deferred
Feb 9 23:34:41 mail sendmail[25472]: r19K40sb008469: to=, delay=08:30:34, xdelay=00:00:01, mailer=esmtp, pri=1592224, relay=mx1.comcast.net. [68.87.26.147], dsn=5.0.0, stat=Service unavailable
Feb 9 23:34:42 mail sendmail[25472]: r19K40sb008469: to=, delay=08:30:35, xdelay=00:00:01, mailer=esmtp, pri=1592224, relay=aspmx.l.google.com. [74.125.137.27], dsn=2.0.0, stat=Sent (OK 1360469627 j10si38617439yhm.116 - gsmtp)
Feb 9 23:35:01 mail sendmail[25981]: r1A4Z1Sf025981: from=munin, size=505, class=0, nrcpts=1, msgid=<201302100435.r1A4Z1Sf025981@mail.trebolroses.com>, relay=munin@localhost
Feb 9 23:35:06 mail sendmail[25982]: r1A4Z1SH025982: from=, size=779, class=0, nrcpts=1, msgid=<201302100435.r1A4Z1Sf025981@mail.trebolroses.com>, proto=ESMTP, daemon=MTA, relay=mail.trebolroses.com [127.0.0.1]
Feb 9 23:35:06 mail sendmail[25981]: r1A4Z1Sf025981: to=root, ctladdr=munin (102/104), delay=00:00:05, xdelay=00:00:05, mailer=relay, pri=30505, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (r1A4Z1SH025982 Message accepted for delivery)
Feb 9 23:35:06 mail MailScanner[25495]: New Batch: Scanning 1 messages, 1315 bytes
Feb 9 23:35:06 mail MailScanner[25495]: Virus and Content Scanning: Starting
Feb 9 23:35:09 mail MailScanner[25495]: Expired 1 records from the SpamAssassin cache
Feb 9 23:35:09 mail MailScanner[25495]: Config Error: Cannot match against destination IP address when resolving configuration option "spamwhitelist"
Feb 9 23:35:09 mail MailScanner[25495]: Config Error: Cannot match against destination IP address when resolving configuration option "spamwhitelist"
Feb 9 23:35:12 mail MailScanner[25495]: Uninfected: Delivered 1 messages
Feb 9 23:35:12 mail MailScanner[25495]: Deleted 1 messages from processing-database
Feb 9 23:35:12 mail sendmail[25994]: r1A4Z1SH025982: to=fernandos, ctladdr= (102/104), delay=00:00:06, xdelay=00:00:00, mailer=local, pri=120779, dsn=2.0.0, stat=Sent
Feb 9 23:35:36 mail sendmail[25921]: r19NCfaV013998: to=, delay=05:22:33, xdelay=00:04:00, mailer=esmtp, pri=1591337, relay=hotmai.com. [207.46.31.61], dsn=4.0.0, stat=Deferred: Connection timed out with hotmai.com.
Feb 9 23:35:37 mail sendmail[25921]: r19NCfaV013998: to=, delay=05:22:34, xdelay=00:00:01, mailer=esmtp, pri=1591337, relay=mx4.hotmail.com. [65.54.188.72], dsn=5.0.0, stat=Service unavailable

por ejemplo en uno de los log veo que dice algo como esto
relay=mx2.sbcglobal.am0.yahoodns.net. [98.138.206.39],
no se si estoy mal o esto me dice de que ip es la que me estan enviando el correo, pero no puedo ver con que usuario lo estan haciendo.

Alguna idea de como parar esto y evitar que siga cayendo en listas negras.

Saludos