Добрый день, помогите разобраться, примерно 2 недели сильно спамит почтовый сервер.

Связка FreeBSD 7.1 + Sendmail 8.14.3 + dbmail-2.2.11 + LDAP

Примерно 200 пользователей.

Почтовая статистика с 03/10/13

mail# mailstats
Statistics from Thu Oct  3 13:00:00 2013
M   msgsfr  bytes_from   msgsto    bytes_to  msgsrej msgsdis msgsqur  Mailer
5    10175     387777K    18991     335195K     5194    9544       0  esmtp
9    10520    1175491K     1215    1269221K        5       3       0  dbmail-lmtp
10    16389     112527K        0          0K        2     516       0  local
=====================================================================
T    37084    1675795K    20206    1604416K     5201   10063       0
C    75812               565457                15264

кусок sendmail -bp:

r949xrh8040566       36 Fri Oct  4 21:02 <rutofi@nsry.ru>
                 (host map: lookup (gmal.com): deferred)
                                         <chenard87@gmal.com>
r9489625024289       43 Fri Oct  4 19:10 <xaji@nsry.ru>
                 (Deferred: Name server: mx2.hanmail.net.: host name lookup fa)
                                         <torcas@hanmail.net>
r948AiUZ024476       45 Fri Oct  4 19:13 <fyqawa@nsry.ru>
                 (host map: lookup (msa.mailcker.com): deferred)
                                         <pfx35090@msa.mailcker.com>
r948CxGC024947       39 Fri Oct  4 19:14 <teleg@nsry.ru>
                 (host map: lookup (gmal.com): deferred)
                                         <crazy44@gmal.com>
r9489623024289       42 Fri Oct  4 19:10 <qa@nsry.ru>
                 (Deferred: Operation timed out with mx1.breakthru.com.)
                                         <ringoffire@breakthru.com>
r949S21D037007       37 Fri Oct  4 20:28 <komo@nsry.ru>
                 (host map: lookup (dbworld.net.au): deferred)
                                         <di@dbworld.net.au>
r946qpj4011877       36 Fri Oct  4 17:53 <deze@nsry.ru>
                 (reply: read error from lycos.it.)
                                         <mory2001@lycos.it>
r948AiUR024476       43 Fri Oct  4 19:13 <nerop@nsry.ru>
                 (Deferred: Operation timed out with mail.efanzonline.com.)
                                         <vmanes2270@brazoria.net>
r946nXQe011468       52 Fri Oct  4 17:52 <fo@nsry.ru>
                 (Deferred: Operation timed out with apnakarachi.com.)
                                         <imranbhatti@apnakarachi.com>
r948EwOw025312       51 Fri Oct  4 19:16 <gypo@nsry.ru>
                 (Deferred: Operation timed out with yahoo.co.)
                                         <charlesmonkey1990air@yahoo.co>
r948CxFr024947       52 Fri Oct  4 19:13 <joqi@nsry.ru>
                 (Deferred: Name server: mx1.hanmail.net.: host name lookup fa)
                                         <1004seoeun@hanmail.net>
r948962j024289       45 Fri Oct  4 19:12 <sywec@nsry.ru>
                 (host map: lookup (vgmail.com): deferred)
                                         <paulygrande9999@vgmail.com>
r948EwOO025312       43 Fri Oct  4 19:15 <xalaku@nsry.ru>
                 (Deferred: Name server: mx4.hanmail.net.: host name lookup fa)
                                         <yong9282@daum.net>
r94866Cf023993       39 Fri Oct  4 19:08 <goto@nsry.ru>
                 (host map: lookup (gmal.com): deferred)
                                         <gwendolyn.matthews@gmal.com>
r946qpjE011877       45 Fri Oct  4 17:53 <rynamo@nsry.ru>
                 (Deferred: Operation timed out with email2db.parklogic.com.)
                                         <accurest@accurest.com>
r945UiPR099781       49 Fri Oct  4 16:30 <jynare@nsry.ru>
                 (Deferred: Name server: mx2.hanmail.net.: host name lookup fa)
                                         <ekfrmadl@hanmail.net>
r944Q9Qw090325       37 Fri Oct  4 15:28 <ceq@nsry.ru>
                 (Deferred: Name server: mx4.hanmail.net.: host name lookup fa)
                                         <midi0107@hanmail.net>
                Total requests: 2422

часть maillog:
Пользователя gen@nsry.ru не существует.

Oct  8 05:46:44 mail sm-mta[6103]: r97Ijwq8006103: from=<gen@nsry.ru>, size=368, class=0, nrcpts=7, msgid=<201310071846.r97Ijwq8006103@mail.nsry.ru>, proto=ESMTP, daemon=IPv4, relay=[77.238.131.219]
Oct  8 05:46:44 mail sm-mta[6103]: r97Ijwq8006103: Milter add: header: X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:44 mail sm-mta[6103]: r97Ijwq8006103: Milter change: header X-SpamTest-Version: from  SMTP-Filter Version 3.0.0 [0284], KAS30/Release to SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:44 mail sm-mta[6103]: r97Ijwq8006103: Milter change (add): header: X-SpamTest-Info: Not protected
Oct  8 05:46:44 mail sm-mta[3747]: r97HsJVO097036: to=<isthatright80@hotmail.com>,<pearce__@hotmail.com>, delay=00:49:26, xdelay=00:00:05, mailer=esmtp, pri=360456, relay=mx2.hotmail.com. [65.54.188.110], dsn=4.0.0, stat=Deferred: Name s
Oct  8 05:46:44 mail sm-mta[75607]: r961Grhv056568: timeout waiting for input from smtp.getontheweb.com. during client greeting
Oct  8 05:46:44 mail sm-mta[75607]: r961Grhv056568: to=<hkjhb@kjhl.com>, delay=1+17:29:50, xdelay=00:05:03, mailer=esmtp, pri=7140449, relay=smtp.getontheweb.com. [66.36.236.47], dsn=4.0.0, stat=Deferred: Name server: smtp.getontheweb.co
Oct  8 05:46:44 mail sm-mta[75607]: r961GQQJ056547: to=<hkjhb@kjhl.com>, delay=1+17:29:55, xdelay=00:00:00, mailer=esmtp, pri=7140460, relay=smtp.getontheweb.com., dsn=4.0.0, stat=Deferred: Name server: smtp.getontheweb.com.: host name l
Oct  8 05:46:45 mail sm-mta[239]: r97FdnA1075904: to=<therat6969@hotmail.com>, delay=03:02:09, xdelay=00:00:04, mailer=esmtp, pri=630327, relay=mx3.hotmail.com. [65.55.92.184], dsn=4.0.0, stat=Deferred: Name server: mx3.hotmail.com.: hos
Oct  8 05:46:45 mail sm-mta[6165]: r97Ijwq7006103: to=<buddycool991@yahoo.com>, delay=00:00:07, xdelay=00:00:04, mailer=esmtp, pri=270417, relay=mta7.am0.yahoodns.net. [66.196.118.37], dsn=2.0.0, stat=Sent (ok dirdel)
Oct  8 05:46:46 mail sm-mta[85199]: r97AbAv9029982: to=<ahernan12@hotmail.com>, delay=08:08:43, xdelay=00:00:05, mailer=esmtp, pri=1260464, relay=mx1.hotmail.com. [65.55.92.184], dsn=4.0.0, stat=Deferred: Name server: mx1.hotmail.com.: h
Oct  8 05:46:46 mail sm-mta[6103]: r97Ijwq9006103: from=<ceg@nsry.ru>, size=304, class=0, nrcpts=5, msgid=<201310071846.r97Ijwq9006103@mail.nsry.ru>, proto=ESMTP, daemon=IPv4, relay=[77.238.131.219]
Oct  8 05:46:46 mail sm-mta[6103]: r97Ijwq9006103: Milter add: header: X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:46 mail sm-mta[6103]: r97Ijwq9006103: Milter change: header X-SpamTest-Version: from  SMTP-Filter Version 3.0.0 [0284], KAS30/Release to SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:46 mail sm-mta[6103]: r97Ijwq9006103: Milter change (add): header: X-SpamTest-Info: Not protected
Oct  8 05:46:46 mail sm-mta[6135]: r97Ijwpv006103: to=<beerpimp2@hotmail.com>, delay=00:00:39, xdelay=00:00:05, mailer=esmtp, pri=60232, relay=mx3.hotmail.com. [65.54.188.126], dsn=4.0.0, stat=Deferred: Name server: mx3.hotmail.com.: hos
Oct  8 05:46:46 mail sm-mta[6135]: r97Ijwpv006103: r97Ikkps006135: DSN: Service unavailable
Oct  8 05:46:46 mail sm-mta[6135]: r97Ikkps006135: to=<fo@nsry.ru>, delay=00:00:00, xdelay=00:00:00, mailer=dbmail-lmtp, pri=31323, relay=[127.0.0.1], dsn=5.1.1, stat=User unknown
Oct  8 05:46:46 mail sm-mta[6135]: r97Ikkps006135: to=MAILER-DAEMON, delay=00:00:00, mailer=local, pri=31323, dsn=5.1.1, stat=User unknown
Oct  8 05:46:47 mail sm-mta[6163]: r97Ijwq6006103: to=<wnouchi@yahoo.com>,<elsanorma28@yahoo.com>, delay=00:00:11, xdelay=00:00:05, mailer=esmtp, pri=90252, relay=mta5.am0.yahoodns.net. [98.136.217.202], dsn=2.0.0, stat=Sent (ok dirdel 2
Oct  8 05:46:48 mail sm-mta[6103]: r97IjwqA006103: from=<futew@nsry.ru>, size=276, class=0, nrcpts=4, msgid=<201310071846.r97IjwqA006103@mail.nsry.ru>, proto=ESMTP, daemon=IPv4, relay=[77.238.131.219]
Oct  8 05:46:48 mail sm-mta[6103]: r97IjwqA006103: Milter add: header: X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:48 mail sm-mta[6103]: r97IjwqA006103: Milter change: header X-SpamTest-Version: from  SMTP-Filter Version 3.0.0 [0284], KAS30/Release to SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:48 mail sm-mta[6103]: r97IjwqA006103: Milter change (add): header: X-SpamTest-Info: Not protected
Oct  8 05:46:48 mail sm-mta[6171]: r97Ijwq9006103: to=<gqf1234@eastday.com>, delay=00:00:04, xdelay=00:00:02, mailer=esmtp, pri=150304, relay=smtp.eastday.com. [117.21.182.8], dsn=5.1.1, stat=User unknown
Oct  8 05:46:49 mail sm-mta[90681]: r97DlF7l058787: to=<leandroa64@hotmail.com>,<lukecollins30@hotmail.com>, delay=04:51:14, xdelay=00:00:06, mailer=esmtp, pri=870292, relay=mx4.hotmail.com. [65.54.188.126], dsn=4.0.0, stat=Deferred: Nam
Oct  8 05:46:49 mail sm-mta[93894]: r97EeiZ7066435: to=<axl9@optonline.net>, delay=03:56:51, xdelay=00:00:15, mailer=esmtp, pri=930438, relay=mx1.optonline.net. [167.206.4.77], dsn=2.0.0, stat=Sent (Ok.)
Oct  8 05:46:49 mail sm-mta[6169]: r97Ijwq8006103: to=<3mrogerh63@hotmail.com>, delay=00:00:07, xdelay=00:00:05, mailer=esmtp, pri=210368, relay=mx1.hotmail.com. [65.54.188.72], dsn=4.0.0, stat=Deferred: Name server: mx1.hotmail.com.: ho
Oct  8 05:46:49 mail sm-mta[3747]: r97HsJUo097036: to=<jcvc_ct@hotmail.com>,<music_gal58@hotmail.com>,<sessiz-kovboy_@hotmail.com>,<y5379@hotmail.com>, delay=00:51:17, xdelay=00:00:05, mailer=esmtp, pri=360460, relay=mx2.hotmail.com. [65
Oct  8 05:46:50 mail sm-mta[6169]: STARTTLS=client, relay=gmail-smtp-in.l.google.com., version=TLSv1/SSLv3, verify=FAIL, cipher=RC4-SHA, bits=128/128
Oct  8 05:46:50 mail sm-mta[6165]: r97Ijwq7006103: to=<katknapp@bmi.net>, delay=00:00:12, xdelay=00:00:05, mailer=esmtp, pri=270417, relay=mx.judy.bmi.net. [50.22.189.59], dsn=4.3.0, stat=Deferred: 451-Destination server doesnt accept th
Oct  8 05:46:51 mail sm-mta[6103]: r97IjwqB006103: from=<qysig@nsry.ru>, size=359, class=0, nrcpts=7, msgid=<201310071846.r97IjwqB006103@mail.nsry.ru>, proto=ESMTP, daemon=IPv4, relay=[77.238.131.219]
Oct  8 05:46:51 mail sm-mta[6103]: r97IjwqB006103: Milter add: header: X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:51 mail sm-mta[6103]: r97IjwqB006103: Milter change: header X-SpamTest-Version: from  SMTP-Filter Version 3.0.0 [0284], KAS30/Release to SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Oct  8 05:46:51 mail sm-mta[6103]: r97IjwqB006103: Milter change (add): header: X-SpamTest-Info: Not protected
Oct  8 05:46:51 mail sm-mta[85199]: r97AZrJn029794: to=<aoza.1982@hotmail.com>, delay=08:10:35, xdelay=00:00:05, mailer=esmtp, pri=1260474, relay=mx3.hotmail.com. [65.54.188.72], dsn=4.0.0, stat=Deferred: Name server: mx3.hotmail.com.: h
Oct  8 05:46:52 mail sm-mta[6165]: STARTTLS=client, relay=gmail-smtp-in.l.google.com., version=TLSv1/SSLv3, verify=FAIL, cipher=RC4-SHA, bits=128/128
Oct  8 05:46:52 mail sm-mta[93894]: r97EeiZ1066435: to=<asa361629@windowslive.com>,<colbrunn@hotmail.com>,<juliecat22@hotmail.com>,<samueli_88@hotmail.com>, delay=03:57:14, xdelay=00:00:03, mailer=esmtp, pri=930438, relay=mx3.hotmail.com
Oct  8 05:46:53 mail sm-mta[6175]: STARTTLS=client, relay=mailin-03.mx.aol.com., version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256
Oct  8 05:46:53 mail sm-mta[90681]: r97DlF8k058787: to=<bsm7100@hotmail.com>,<ohyeeheng@hotmail.com>,<x.x39@hotmail.com>, delay=04:48:11, xdelay=00:00:04, mailer=esmtp, pri=870296, relay=mx2.hotmail.com. [65.55.92.152], dsn=4.0.0, stat=D
Oct  8 05:46:53 mail sm-mta[90681]: r97DlF8k058787: r97H4HaN090681: sender notify: Warning: could not send message for past 4 hours
Oct  8 05:46:54 mail sm-mta[90681]: r97H4HaN090681: to=<vijelu@nsry.ru>, delay=00:00:01, xdelay=00:00:01, mailer=dbmail-lmtp, pri=31727, relay=[127.0.0.1], dsn=5.1.1, stat=User unknown
Oct  8 05:46:54 mail sm-mta[90681]: r97H4HaN090681: to=MAILER-DAEMON, delay=00:00:01, mailer=local, pri=31727, dsn=5.1.1, stat=User unknown
Oct  8 05:46:54 mail sm-mta[6171]: r97Ijwq9006103: to=<grlsmiley16@hotmail.com>,<rpy100@hotmail.com>,<martinra@hotmail.com>, delay=00:00:10, xdelay=00:00:05, mailer=esmtp, pri=150304, relay=mx3.hotmail.com. [65.55.37.88], dsn=4.0.0, stat
Oct  8 05:46:54 mail sm-mta[6144]: r97Ijwq0006103: to=<jirsongterangdily@gmail.com>, delay=00:00:39, xdelay=00:00:32, mailer=esmtp, pri=300434, relay=gmail-smtp-in.l.google.com. [173.194.71.26], dsn=5.0.0, stat=Service unavailable
Oct  8 05:46:54 mail sm-mta[6139]: r97Ijwpw006103: to=<natethegreat53079@gmail.com>, delay=00:00:46, xdelay=00:00:33, mailer=esmtp, pri=150320, relay=gmail-smtp-in.l.google.com. [173.194.71.26], dsn=5.0.0, stat=Service unavailable
Oct  8 05:46:54 mail sm-mta[3747]: r97HsJVJ097036: to=<dtfktown@hotmail.ca>, delay=00:49:51, xdelay=00:00:05, mailer=esmtp, pri=360463, relay=mx3.hotmail.com. [65.54.188.126], dsn=4.0.0, stat=Deferred: Name server: mx3.hotmail.com.: host
Oct  8 05:46:55 mail sm-mta[6103]: r97IjwqC006103: from=<pire@nsry.ru>, size=409, class=0, nrcpts=9, msgid=<201310071846.r97IjwqC006103@mail.nsry.ru>, proto=ESMTP, daemon=IPv4, relay=[77.238.131.219]