spam on exchange

Hi all,

Relative newbie to Exchange. SBS2003.

Just came into a situation where the client’s Exchange has been hit with a virus. Not clear where it came from, but the queue has been inundated with junk going out. It did lead to the client getting blacklisted.

I made sure the relay is turned off and have been monitoring the server for any suspicious behaviour.

I turned on message tracking and now I can see the history of any spam flurry, but the problem is that I don’t know which machine (they have about 50 PCs) it is coming from.

Is there a way to see the originating point of a message?

thanks

Nate