One of our clients recived an e-mail that they were hosting unsoliceted bulk e-mail. they said that the originating ip was the ip of the outside of the proxy. Now how the heck do i go about figuring out what workstation it is?

Topo of network
all win98se workstations
1 novell 5.0 fileserver
1 novell bordermanager server (firewall, proxy)
2500 cisco router on the outside of the firewall

there is no exchange server or groupwise server on the network.

any help would be much appreciated.

Thanks guys/gals