Possibly a stupid idea, but... One of the worstations attached to your server couild be a victim of Doom, meaning that you are spewing hundreds of email per hour outbound under all sorts of fictitious names - not related to you at all. This at first glance looks like relaying, just happened to one of my clients on a windoes box using winproxy. First, looking at the logs, I panicked, assumed the box was used as a mail-relay, and shut it down. Not at all, done the testing, foolproof. The traffic was traced to doomA on the main desk PC.... Got the server back up after disconnecting the guilty workstation, cleaned it, all back in order. Only genuine mail from registered users.