My SMTP server transferring out Terabytes of data in a day [duplicate]

Solution 1:

The most likely reason is that the server is compromised.

In the most simple case: the server is not configured correctly and it can be used as an open relay, allowing anyone to use your mailserver to send spam.

You can diagnose that (and other issues) by checking the log files on the server.

Potentially the mail server itself is fine, as such abuse can also occur when the server is configured correctly, but the credentials of valid user are getting abused, or the source the abuse is a trusted system/sender elsewhere in your network and you've only started to noticed the effects of that compromise on the mail server. Again: check you log files.


In more serious cases your server is fully compromised. Then you may not even have log files anymore or when you do, they may not show any obvious abuse and can't be trusted...
Then read: How do I deal with a compromised server?