The View Usage Report tool may report many e-mail messages in Windows Small Business Server 2003 (867457)

SYMPTOMS

When you use the View Usage Report tool in Microsoft Windows Small Business Server 2003 to verify the number of e-mail messages that are sent from your Microsoft Exchange server, a high number may be reported.

The View Usage Report tool may report that one or more users have sent an unusually high number of e-mail messages. This behavior may lead you to suspect that there is an e-mail virus that is active on the network. You may also suspect that someone has compromised a user's account or password and is using the mail server to relay unauthorized messages.

However, the antivirus program that is scanning Exchange e-mail messages is not detecting a problem, and you cannot find the corresponding messages in Exchange System Manager's Message Tracking tool.

Additionally, if you enable diagnostic logging for the Exchange Transport component, the Application log does not indicate that an unauthorized user is authenticating against the Simple Mail Transfer Protocol (SMTP) service.

Note If you have diagnostic logging for the Exchange Transport component set to High, and a remote user is authenticating against the SMTP service to relay messages, you will see an event that is similar to the following in the Application log:
Event ID: 1708
Event Type: Information
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
User: N/A
Computer: servername
Description: SMTP Authentication was performed successfully with client remote_computername. The authentication method was LOGIN and the username was company\username.

CAUSE

This problem occurs because the View Usage Report tool in Windows Small Business Server 2003 counts the copies of an e-mail message incorrectly when you send an e-mail message to multiple users with unique domain mail addresses. For example, if you copy a message to four users in three different domains, the View Usage Report tool multiplies the four user messages by the three domains and reports a total of twelve messages. The actual number of messages is four. This behavior may cause the View Usage Report tool to report that a single user is responsible for hundreds or even thousands of e-mail messages in a day.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

This problem was first corrected in Windows Small Business Server 2003 Service Pack 1.

If you have verified that no relaying spam or e-mail viruses exist, you can safely ignore the number of e-mail messages that are reported by the View Usage Report tool.