Span from Apache Web Server

[MTSU_SAN]

Recently, someone on campus has been sending spam, and the return address shows up as httpd@mtsu.edu (which boils down to our Apache Web Server).
How do they do that, and is there anyway that I can block it or stop it??

[Ron Cornwell]

There are several products out there that will allow you to mask the email address you are sending from ( blat for example). Another way this can be done is to telnet directly to port 25 on the mail server and the you can tell who you want your email to go to and who you want it to look like it came from.

[Kevin Wright]

anyone can do this with a connection to the internet...
/usr/lib/sendmail -f"anyone@anydomain.com toanyone@anywhere"

as long as 'anydomain' resolves to a 'real' domain through the DNS lookup performed by the recieving mail server, this will work.

[MTSU_SAN]

I mispoke. The Received from: address is httpd@localhost on our web server machine. Sendmail only forces the From: address, and even then an authorization warning is produced by our configuration.

[MTSU_SAN]

This has been partially resolved--they were using FormMail (our campus-wide copy) and specifying email, Subject and message body in the URL.
Haven't figured out how to block this yet without censoring messages...