Originally posted here by RoadClosed
I am burnt, fixed and cleaned. I had and authenticated relay so I got had by some poor password maintenance. It looks like the spammer authenticated my local box admin account with a bot. How you ask? Got me didn't know that could be possible through telnet? I now see some lacking in Exchange knowledge that I must fix. I had log entries of //MachineName/Administrator popping up the 1708 id. The cleanup was ugly I am tired so I'll talk more on it tomorrow if anyone want too. You can all beat me with the AO stick of justice.
Hey Road - I try to mitigate the risk to the admin account by changing the admin account name to something cryptic, and I also give the account a very complex password. Now that the default name for the admin account is no longer valid, all telnet attempts to the "administrator" account will fail. I also have my IDS systems sniff failed FTP logon attempts, which helps me to resolve/trace telnet attacks against the admin aco****.

The view of "an ounce of prevention is worth a pound of cure."

Not trying to be preachy Road. I learned the hard way once also. Grrr!