I have a single user account that is being used to send spam, creating and filling queues in Exchange by the hundreds. When I disable the account the spam stops. I’ve changed the password on the account thinking it was compromised but as soon as I activate the account the spam begins again.
I have confirmed that open relaying does not exist. I currently have message tracking turned off as the log file exploded overnight filling the drive and stopping Exchange in its tracks (which is how I found out about this).