It looks like the receiving mail server isn't properly supporting our SMTP methods, are you able to deliver mail to other users on this server? As to the Anonymous User you saw, this is expected and simply indicates there was a user at the login page that had not yet authenticated. Once the user logs in the username displayed will change to reflect the account they authenticated with.

Thanks for the reply. There were 2 IP addresses (103.28.41.114, 103.28.41.113) doing the same thing. I looked at my SMTP logs and these 2 where attempting to Authenticate several thousand times a day. I think they were some sort of "Scouting" Bots because once I added them to my Blacklist my spam literally stopped, and I was getting hammered some days! I continued to review other IP addresses that were attempting to "Authenticate as" an unknown user from dodgy places like Russia, China, Kenya, South Africa, Lithuania etc.. I was able to export my logs and then import into MS Access then query the most abusive ones. After blocking them all I'm not seeing any garbage like this. The logs are 99% normal now!

I still do not understand how something could be trying to deliver mail from my internal mail server to another mail server without any sort of authentication.

Thanks

Dave Stuart