Greetings all:

My Zimbra server has been black listed and I cannot figure out if I have a spam bot on the network or a user account has been compromised. The spams are definitely going through the Zimbra server but I am not finding much in the logs to help me. I looked at a daily admin report and I need to clarify that the "Top 50 Senders" are, in fact, emails that are being sent from my server. There are SEVERAL addresses on this list that are NOT from my domain. Any help would be appreciated. Thank you.