I have seen this happen before as well. What I do is change the password, disable the account and restart the SM service. That has kicked them off for me every time. Also, you mentioned compromised accounts. My company, Mail's Best Friend, offers a free program called Declude. It comes with a component called Hijack which prevents mass amounts of spam from leaving your server in the case of a compromised account. When it stops the mail from going out, it alerts you via email so you can log into your server and see who's account is compromised. If you would like to give it a try, you can download it at the following link: http://mailsbestfriend.com/downloads/ Please let me know if you have any questions. Thanks!