Hallo,
erstmal vielen Dank schon mal für deine Antwort.
Am Ende ist der Log für eine E-Mail angehängt. Für mich ergibt sich jetzt daraus, dass dies doch von extern kommt. Das heißt, die Absenderadresse war gefälscht? Bekommen nur wir gefälschte Mails unserer Mail-Adresse?
Aktive Antispam-Einstellungen sind IP-Sperrliste und IP-Zulassungsliste (unter Serverkonfiguration in der EMC) und Absenderfilterung, Absenderzuverlässigkeit, Anbieter für zugelassene IP-Adressen, Empfängerfilterung, Inhaltsfilterung, IP-Sperrliste, IP-Sperrlistenanbieter, IP-Zulassungsliste, Sender ID (unter Organistaionskonfiguration in der EMC).
POP-Connector ruft er zyklisch ab (wegen Redundanz), ansonsten landen die Mails direkt auf dem SBS.
Viele Grüße
#Software: Microsoft Exchange Server
#Version: 14.0.0.0
#Log-type: SMTP Receive Protocol Log
#Date: 2016-03-18T16:29:32.827Z
#Fields: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context
2016-03-18T19:26:21.322Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,0,192.168.2.2:25,187.150.55.172:57972,+,,
2016-03-18T19:26:21.323Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,1,192.168.2.2:25,187.150.55.172:57972,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2016-03-18T19:26:21.323Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,2,192.168.2.2:25,187.150.55.172:57972,>,"220 mail.ourcompany.info Microsoft ESMTP MAIL Service ready at Fri, 18 Mar 2016 20:26:20 +0100",
2016-03-18T19:26:21.627Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,3,192.168.2.2:25,187.150.55.172:57972,<,EHLO dsl-187-150-55-172-dyn.prod-infinitum.com.mx,
2016-03-18T19:26:21.627Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,4,192.168.2.2:25,187.150.55.172:57972,>,250-mail.ourcompany.info Hello [187.150.55.172],
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,5,192.168.2.2:25,187.150.55.172:57972,>,250-SIZE 10485760,
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,6,192.168.2.2:25,187.150.55.172:57972,>,250-PIPELINING,
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,7,192.168.2.2:25,187.150.55.172:57972,>,250-DSN,
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,8,192.168.2.2:25,187.150.55.172:57972,>,250-ENHANCEDSTATUSCODES,
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,9,192.168.2.2:25,187.150.55.172:57972,>,250-AUTH LOGIN,
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,10,192.168.2.2:25,187.150.55.172:57972,>,250-8BITMIME,
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,11,192.168.2.2:25,187.150.55.172:57972,>,250-BINARYMIME,
2016-03-18T19:26:21.628Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,12,192.168.2.2:25,187.150.55.172:57972,>,250 CHUNKING,
2016-03-18T19:26:21.852Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,13,192.168.2.2:25,187.150.55.172:57972,<,MAIL FROM:<bestimmterbenutzer@ourcompany.info>,
2016-03-18T19:26:21.853Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,14,192.168.2.2:25,187.150.55.172:57972,*,08D34E6980389F08;2016-03-18T19:26:21.322Z;1,receiving message
2016-03-18T19:26:21.853Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,15,192.168.2.2:25,187.150.55.172:57972,<,RCPT TO:<bestimmterbenutzer@ourcompany.info>,
2016-03-18T19:26:21.857Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,16,192.168.2.2:25,187.150.55.172:57972,<,DATA,
2016-03-18T19:26:21.857Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,17,192.168.2.2:25,187.150.55.172:57972,>,250 2.1.0 Sender OK,
2016-03-18T19:26:21.857Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,18,192.168.2.2:25,187.150.55.172:57972,>,250 2.1.5 Recipient OK,
2016-03-18T19:26:21.857Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,19,192.168.2.2:25,187.150.55.172:57972,>,354 Start mail input; end with <CRLF>.<CRLF>,
2016-03-18T19:26:22.968Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,20,192.168.2.2:25,187.150.55.172:57972,*,Tarpit for '0.00:00:01.050' due to 'DelayedAck',Delivered
2016-03-18T19:26:22.968Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,21,192.168.2.2:25,187.150.55.172:57972,>,250 2.6.0 <FD2E5A40815990F0FF87278BF9@BORO-SBS.boro.local> [InternalId=92] Queued mail for delivery,
2016-03-18T19:26:23.199Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,22,192.168.2.2:25,187.150.55.172:57972,<,QUIT,
2016-03-18T19:26:23.199Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,23,192.168.2.2:25,187.150.55.172:57972,>,221 2.0.0 Service closing transmission channel,
2016-03-18T19:26:23.199Z,OURSERVER\Windows SBS Internet Receive OURSERVER,08D34E6980389F08,24,192.168.2.2:25,187.150.55.172:57972,-,,Local