Question : Undelivered Mail Returned to Sender User EMail Sppofed? How can I stop this?

Undelivered Mail Returned to Sender I have 2 users on my network that I am guessing have had their email spoofed and are getting a lot of Undelivered Mail Returned to Sender emails from emails they did not send.  I know there is a way inside of exchange to stop this, I just cant remember how, any help would be greatly appreciated

thanks

Answer : Undelivered Mail Returned to Sender User EMail Sppofed? How can I stop this?

We are experencing the same problem. Its happening to about 12 users and 100s of inboud  Undelivered Mail Returned to Sender that has the users email address, but they didn't send it out. I have tested my exchange for open relays and its not. I have checked and we are not blacklisted. From what it looks like an external source who has our users email got hit and we are the victims of spammers using out email address as the the sent from address. However it didn't come from us. What can we do?

I have replaced our domain name and email address in this post to protect us from additional attaches.
EXAMPLE: ------------->>
Microsoft Mail Internet Headers Version 2.0
Received: from GrTechnoF.grouptechno.ru ([81.23.106.75]) by OUR.SERVER.NAME with Microsoft SMTPSVC(6.0.3790.3959);
       Tue, 29 Apr 2008 22:40:06 -0700
Received: by GrTechnoF.grouptechno.ru (sendmail)
      id 1BB3758DE9; Wed, 30 Apr 2008 09:40:05 +0400 (MSD)
Date: Wed, 30 Apr 2008 09:40:05 +0400 (MSD)
From: MAILER-DAEMON@grouptechno.ru (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: [email protected] <Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
      boundary="4A78758C73.1209534005/GrTechnoF.grouptechno.ru"
Message-Id: <20080430054005.1BB3758DE9@GrTechnoF.grouptechno.ru>
Return-Path: <>
X-OriginalArrivalTime: 30 Apr 2008 05:40:06.0841 (UTC) FILETIME=[A5759290:01C8AA84]
X-TM-AS-Product-Ver: SMEX-7.5.0.1243-5.5.1026-15880.004
X-TM-AS-Result: No-0.579600-4.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

--4A78758C73.1209534005/GrTechnoF.grouptechno.ru
Content-Description: Notification
Content-Type: text/plain; charset=us-ascii

--4A78758C73.1209534005/GrTechnoF.grouptechno.ru
Content-Description: Delivery report
Content-Type: message/delivery-status

--4A78758C73.1209534005/GrTechnoF.grouptechno.ru
Content-Description: Undelivered Message
Content-Type: message/rfc822

Received: from 115.134.227.121.broad.sz.js.dynamic.163data.com.cn (unknown [121.227.134.115])
      by GrTechnoF.grouptechno.ru (sendmail) with ESMTP id 4A78758C73
      for ; Wed, 30 Apr 2008 09:40:04 +0400 (MSD)
Message-ID: <000501c8aa84$01701d4e$7327bc94@nvgqr>
From: "Hermes Watches" >
To: "Watches"
Subject: Tag Heuer Replica Models
Date: Wed, 30 Apr 2008 03:52:50 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
      boundary="----=_NextPart_000_0002_01C8AA84.016C8BB2"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198

------=_NextPart_000_0002_01C8AA84.016C8BB2
Content-Type: text/plain;
      charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_000_0002_01C8AA84.016C8BB2
Content-Type: text/html;
      charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_000_0002_01C8AA84.016C8BB2--

--4A78758C73.1209534005/GrTechnoF.grouptechno.ru--