Exchange 2003 - непонятные письма - Open Relay ?

[FedyaT Профиль]

В домене mydomain.ru работает exchnage server 2003 back-end и front-end
вся присланая почта помимо адресатов форвардится в один спец ящих для дальнейших разборов
сегодня смотрю письмо - неясно откуда и кому пришло .
Посмотрел тело все равно так и непонял кому пришло письмо -
неясно как оно прошло через сервер
open relay ?
да вроде проверялся недавно недели три назад на ORDB
Есть идеи ?
причем письмо не спамовое а нормальное - в рабочем порядке
и контора в теле указана знакомая - че за хрень ?
вот тело письма


Microsoft Mail Internet Headers Version 2.0
Received: from mydomain.ru ([192.168.0.12]) by mydomain.ru with Microsoft SMTPSVC(6.0.3790.1830);
Thu, 4 Aug 2005 14:41:17 +0400
Received: from smtp1.masterhost.ru ([83.222.24.101]) by mydomain.ru with Microsoft SMTPSVC(6.0.3790.1830);
Thu, 4 Aug 2005 14:41:16 +0400
Received: (qmail 62692 invoked from network); 4 Aug 2005 10:40:24 -0000
Received: from unknown (HELO user5389c87f38) (rza%vniie.ru@213.85.19.129)
by smtp1.masterhost.ru with SMTP; 4 Aug 2005 10:40:21 -0000
X-AntiVirus: Checked by Dr.Web [version: 4.32b, engine: 4.32b, virus records: 82671, updated: 4.08.2005]
Message-ID: <003201c598e0$e4dc8280$5300a8c0@user5389c87f38>
From: =?koi8-r?B?89fF1MzBzsEg98zBxMnNydLP187B?= <svp@vniie.ru>
To: =?koi8-r?B?98HSydfPxM/XIPcu7i4=?= <rimsan-vn@rao.elektra.ru>
Subject: =?koi8-r?B?9d7F1M7B0SDQz8zJ1MnLwQ==?=
Date: Thu, 4 Aug 2005 14:40:12 +0400
Organization: =?koi8-r?B?7vTjIObz6w==?=
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_002E_01C59902.6B6FCAC0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Return-Path: svp@vniie.ru
X-OriginalArrivalTime: 04 Aug 2005 10:41:16.0464 (UTC) FILETIME=[0AB53B00:01C598E1]

------=_NextPart_000_002E_01C59902.6B6FCAC0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_002F_01C59902.6B6FCAC0"

------=_NextPart_001_002F_01C59902.6B6FCAC0
Content-Type: text/plain;
charset="koi8-r"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_001_002F_01C59902.6B6FCAC0
Content-Type: text/html;
charset="koi8-r"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_001_002F_01C59902.6B6FCAC0--
------=_NextPart_000_002E_01C59902.6B6FCAC0
Content-Type: application/msword;
name="=?koi8-r?B?9d7F1M7B0V/Qz8zJ1MnLwSDu9ONf4vUuZG9j?="
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="=?koi8-r?B?9d7F1M7B0V/Qz8zJ1MnLwSDu9ONf4vUuZG9j?="


------=_NextPart_000_002E_01C59902.6B6FCAC0--




на back-end логи пишутся полные
на front-end - не полные - включил полные

часть лога с Back-end сервера

005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 x-exps - +GSSAPI 0 0 22 13 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 x-link2state - +LAST+CHUNK={0000006a}+MULTI+(5)+({00000051}+DIGES T_QUERY+9a16b1294e521c46ac9e9e67f755643c+e6208a7eb 5aef9ca9b86b3d5665304da++)++ 200 0 68 140 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 MAIL - +FROM:<> 250 0 27 30 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 RCPT - +TO:<mailbox@mydomain.local> 250 0 0 29 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 xexch50 - +1140+2 354 0 22 14 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 BDAT - +<75c001c598ff$8f536376$6f29b18f@wongfaye.com> 250 0 83 6897 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 MAIL - +FROM:<adroit@wongfaye.com> 250 0 44 49 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 RCPT - +TO:<docenko@mydomain.ru> 250 0 0 26 31 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 xexch50 - +1108+2 354 0 22 14 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 BDAT - +<75c001c598ff$8f536376$6f29b18f@wongfaye.com> 250 0 83 6897 0 SMTP - - - -
2005-08-04 14:34:32 192.168.0.12 mydomain.ru SMTPSVC1 ROSEP2 192.168.0.7 0 QUIT - mydomain.ru 240 63 57 4 0 SMTP - - - -
2005-08-04 14:40:10 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 HELO - +rosep2.mydomain.local 250 0 35 23 0 SMTP - - - -
2005-08-04 14:40:10 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 MAIL - +FROM:+<Power@mydomain.ru> 250 0 39 27 16 SMTP - - - -
2005-08-04 14:40:10 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 RCPT - +TO:+<tehno@mydomain.ru> 250 0 0 25 0 SMTP - - - -
2005-08-04 14:40:10 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 DATA - <ROSEP21rjlwf2fw3cLE000000c5@mydomain.ru> 250 0 121 549 203 SMTP - - - -
2005-08-04 14:40:10 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 QUIT - rosep2.mydomain.local 240 343 57 4 0 SMTP - - - -
2005-08-04 14:41:00 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 HELO - +rosep2.mydomain.local 250 0 35 23 0 SMTP - - - -
2005-08-04 14:41:00 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 MAIL - +FROM:+<Power@mydomain.ru> 250 0 39 27 0 SMTP - - - -
2005-08-04 14:41:00 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 RCPT - +TO:+<tehno@mydomain.ru> 250 0 0 25 0 SMTP - - - -
2005-08-04 14:41:00 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 DATA - <ROSEP2OGj3TSXpioECg000000c6@mydomain.ru> 250 0 121 526 172 SMTP - - - -
2005-08-04 14:41:00 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 QUIT - rosep2.mydomain.local 240 360 57 4 0 SMTP - - - -
2005-08-04 14:47:45 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 HELO - +rosep2.mydomain.local 250 0 35 23 0 SMTP - - - -
2005-08-04 14:47:45 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 MAIL - +FROM:+<Power@mydomain.ru> 250 0 39 27 0 SMTP - - - -
2005-08-04 14:47:45 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 RCPT - +TO:+<tehno@mydomain.ru> 250 0 0 25 0 SMTP - - - -
2005-08-04 14:47:45 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 DATA - <ROSEP2ZCrhoUa5ghceK000000c7@mydomain.ru> 250 0 121 549 125 SMTP - - - -
2005-08-04 14:47:45 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 QUIT - rosep2.mydomain.local 240 282 57 4 0 SMTP - - - -
2005-08-04 14:50:37 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 HELO - +rosep2.mydomain.local 250 0 35 23 0 SMTP - - - -
2005-08-04 14:50:37 192.168.0.89 rosep2.mydomain.local SMTPSVC1 ROSEP2 192.168.0.7 0 MAIL - +FROM:+<Power@mydomain.ru> 250 0 39 27 31 SMTP - - - -



часть лога с Front-end сервера

14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 X-LINK2STATE - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 MAIL - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 RCPT - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 XEXCH50 - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 BDAT - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 RSET - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 MAIL - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 RCPT - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 XEXCH50 - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 BDAT - 0
14:34:31 192.168.0.7 - - 0
14:34:31 192.168.0.7 QUIT - 0
14:34:31 192.168.0.7 - - 0
14:34:46 217.129.248.222 QUIT - 240
15:03:00 211.204.48.89 HELO - 250
15:03:00 211.204.48.89 MAIL - 250
15:03:02 211.204.48.89 RCPT - 250
15:03:02 211.204.48.89 RCPT - 250
15:03:03 211.204.48.89 RCPT - 250
15:03:03 211.204.48.89 RCPT - 250
15:03:05 211.204.48.89 RCPT - 250
15:03:05 211.204.48.89 RCPT - 250
15:03:06 211.204.48.89 RCPT - 250
15:03:06 211.204.48.89 RCPT - 250
15:03:07 211.204.48.89 RCPT - 250
15:03:07 211.204.48.89 RCPT - 250
15:03:10 211.204.48.89 DATA - 250
15:03:10 192.168.0.7 - - 0
15:03:10 192.168.0.7 EHLO - 0
15:03:10 192.168.0.7 - - 0
15:03:10 192.168.0.7 - - 0
15:03:10 192.168.0.7 EHLO - 0
15:03:10 192.168.0.7 - - 0
15:03:10 192.168.0.7 - - 0
15:03:10 192.168.0.7 - - 0
15:03:10 192.168.0.7 - - 0
15:03:10 192.168.0.7 X-LINK2STAT

какие будут идеи ?
Откуда письмо как попало ?