X-Mailer: iPhone Mail Spoofing... Defense Suggestions?

[jmair]

About once a month I'll have a user that's bombarded by undeliverable emails (roughly 1,000+- of them). Each of these have one thing in common. A line that reads "X-Mailer: iPhone Mail ". Though they display the origin of the server as mine. I am skeptical that it's coming from my server, primarily because I've exhausted any additional way to find it on my exchange server.

 

Is there a way to protect against these types of attacks or ways to some how trace where they could be actually originating from? I'm open to any suggestions really.

Thank you kindly!

 

Jmair

[MatthewL]

Get the user in question to login to webmail and you can see what devices are connected to that account, you can disable them from there so you can see if a compromised device is doing it.