Problem with securing email server

bounced email returned undeliverable

[nativenewyorker]

I was surprised to find that an email that I did not send got returned to me as undeliverable. As I do not maintain any mailing lists for my website and do not use formmail of any kind, I disabled formmail as well as post.

My .htaccess file contains the following two entries (with the solid vertical pipe).

<Limit POST PUT DELETE>
order deny,allow
deny from all
</Limit>

SetEnvIfNoCase Request_URI formmail ban
<Files ~ "\.cgi$¦\.pl$">
order deny,allow
deny from env=ban
</Files>

I referenced this article about formail [webmasterworld.com] to check that my .htaccess file was configured correctly. Prior logs have shown 403's for all formmail requests through the cgi-bin directory, but the cgi-sys directory shows 200's.

Any ideas how this spammer hacked my email?

Thanks in advance,
Ted

[robho]

Look in the headers (in the original message that was returned, not the message quoting it). Maybe it wasn't sent from or through your machine, but just contains forged non-existant reply addresses at your domain, there seems to be a real plague of this at the moment - see [webmasterworld.com...]