We have an Edge Transport Server expose to internet and open relay has been disabled.
However, recently we find there are some spam email sent out from our email server.
We do not have any anonymous SMTP connectors in organization.
So ,we suspect there may be user password leakage, or there may be some computers have been compromised.
As the email must send from an authenticated user from Exchange, we are trying to find out the user name of spam email.
We looking into Message Trace Log, find out the spam email message and e find a field named "Sender" with content "MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@domain".
While, the next question left , How to find out user name from above Sender?