Hello, I run Exchange 2000 and have a user who keeps receiving the
same message every 66 minutes from a sender outside our server. The
message is not spam and it is from someone that we correspond with
daily. The sender is an individual user who just uses SMTP through her
ISP. We've eliminated anything on her PC causing the problem because
the messages keep coming even with her computer completely turned off.

So, the message is either stuck in our Exchange server or in some
intermediate server between her PC and our Exchange machine. We run a
very basic setup here and I've not been able to see that message
waiting in any type of queue.

Here are the headers with a few minor changes for privacy reasons:

Microsoft Mail Internet Headers Version 2.0
Received: from mout.perfora.net ([217.160.230.41]) by rw.corp.foo2.org
with Microsoft SMTPSVC(5.0.2195.6713);
	 Mon, 21 Jun 2004 21:57:28 -0700
Received: from 67.169.24.61 (helo=wendythinkpad)
	by mrelay.perfora.net with ESMTP (Nemesis),
	id 1RrPDu-29Rv-0AAyxe-0000e7; Fri, 18 Jun 2004 15:40:26 -0400
Reply-To: <wendy@foo.org>
From: "Wendy" <wendy@foo.org>
To: "Robert Roberts" <rob@foo2.org>
Subject: RE: we should try this out
Date: Fri, 18 Jun 2004 12:39:54 -0700
Message-ID: <000611c4443c$144658c0$6101a8c0@wendythinkpad>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0007_01C45531.67E780C0"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
In-Reply-To: <BA8955E74555554C90266B08A222F50914E3C1@rw.corp.foo2.org>
Return-Path: wendy@foo.org
X-OriginalArrivalTime: 22 Jun 2004 04:57:28.0281 (UTC) FILETIME=[6AD04C90:01C45815]

------=_NextPart_000_0007_01C45531.67E780C0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit


If I can clarify any additional information, let me know. thanks.

Is it possible that the message is being sent by a third party who is
infected with a worm (trojan, etc.) of some kind and who has your
users' email addresses on their system?

Is the IP address of the sending computer (67.169.24.61) the same IP
address that your "individual user" has on her home internet
connection?

(She can easily check her IP by going to the website
www.whatismyip.com from her home computer)