Who is sending through my GWIA?

GW2014.0.2-120664 running on SLES 11.3

Noticed some suspicious activity in my GWIA logs:

23:43:47 295F MSG 4024405  Command:  eoi.mc
23:43:47 295F MSG 4024405  Response: 220 mtaipromx.mail.monaco.mc ESMTP
23:43:47 295F MSG 4024405  Command:  EHLO  XXXX.XXXX.com
23:43:47 295F MSG 4024405  Response: 250 ok
23:43:47 295F MSG 4024405  Command:  MAIL FROM:<ljakobsen@ddtid.dk>
23:43:47 295F MSG 4024405  Response: 553 #5.1.8 Domain of sender address <ljakobsen@ddtid.dk> does not exist

This repeats every sixty-seconds, attempting delivery to different email servers each time. The account (<ljakobsen@ddtid.dk>) is not a legitimate user on our system.  Looks to me like a bot has discovered my GWIA and is using it to relay. My GWIA requires authentication, but I cannot tell from the log which account is being used to send.

Does anyone have any advice on how I might find that information?

Tags: