Are you or one of your customers running formmail.pl? Do you know if your mail ports are allowing open relays?