HAd a Customer with a problem like this.. except the Mail settings would be changed as well..
the upshot.. had Netsky.p and Agobot Removed these to suckers and setup a Smoothy box.

Netsky was email virus, and agobot was an internet worm, it got through inspite of dopy GRC.COM's shields up saying ALL ports were stealth..


BTW: Smoothy = Smoothwall express