Hi Tim. I'm sorry to hear that this happened. We see compromised accounts every day. Our process for dealing with them is to first change the password on the offending account and then restart the SM service on our servers to knock the offending user off. It's strange because sometimes simply changing the password is enough to stop them, but other times, we have to restart the SM service, so we have made it a rule to restart the service every time after changing the password. Also, I'm not sure if you are aware, but we offer a free program called Declude Hijack which prevents mass amounts of spam from leaving the server in the event of a compromised account. You can download Declude here: http://mailsbestfriend.com/downloads/ Also, we wrote a very helpful article which will give you an idea of how to handle compromised accounts. Please check it out here if you wish: http://know.mailsbestfriend.com/papers/Handling-Compromised-Accounts.shtml. If you would like to read about how Hijack works, please check out our manual: http://mailsbestfriend.com/downloads/docs/Declude_Hijack_Manual.pdf. Please let me know if you have any questions or need help setting up Declude Hijack if you choose to do that. I hope this info helps. Thanks!