Exchange 5.5 SP4 on one machine, GFI MailEssentials and MailSecurity on
seperate server, for filtering.

I work for a K - 12 school and the network admin (and the admin for
pretty much anything else associated with a computer).

We recently had out xmas break. One teacher set up her out of office
assistant.

A spam got through our GFI MailEssentials filtering server with a fake
return address. Her OOOA replied to it and forwarded the spam to her
personal account. Since the spam return email addy was fake, she was
sent a NDR email... at which point the infinite loop started... since
our xmas break is about 3 weeks long, you can guess what happened.

I arrive a day before school started back, deleted her 14,000+ emails,
and disabled her out of office assistant.

I downloaded and installed KB837794 that tells exchange not to even
generate NDRs anymore. My GFI modules dont create any either (didnt to
begin with.)

I went so far as to disable her mail account (she didnt mind, doesnt
miss getting emails). I have a program on my GFI server that allows me
to monitor incoming and outgoing mail. Not read it, but see who it is
from, the subject, who it is to, and if it was processed ok (called
"GFI content security monitor"). This sucker was processing about 4
NDRs per second for this user. All saying (with a date and time stamp
for each):

"Processing new item.
Subject: Delivery Status Notification (Failure) or (Delay)
Sender: <>
Recipient to: (my users email address)
Item processed ok"

Needless to say, this bogs my GFI server down. Meaning some emails are
4 hours late, sometimes 10 hours late, and some just dont come in at
all (or go out), giving the sender a bounced back email.

Funny thing is that yesterday and today I thought my troubles were
over. The info above was no longer flowing through my GFI monitor.
NORMAL emails were coming in and going out. This went on for about 6 or
7 hours. Then, the looping came back.

I have contacted GFI tech support and their only suggestion is for me
to sit and "ride it out" until GFI is done processing those 3 weeks
work of NDRs. Since i have disabled her OOOA, it shouldnt be creating
any new ones, just processing old ones....

But the 6 to 7 hour "break" it takes baffles me... heck, the whole darn
situation baffles me because i feel like i can do NOTHING!

I guess my question is... do I, in fact, just have to sit and wait it
out?

Thanks in advance....
Jazz Mann