Brute-Force attacks from server itself?

[Cybex]

Hi,

Since I moved all my websites from old servers to new servers (3 weeks ago) I get bizarre Brute-Force attack e-mails.

13253739010000	111.222.333.444	[email protected]	1	exim1	2012-01-01 00:24:57 login authenticator failed for server1.mydomain.com [111.222.333.444]: 535 Incorrect authentication data ([email protected])

I get lot's of these Brute-Force errors and always for the same e-mail address. The domain.com domain is mine, but it's not located on server1.mydomain.com.
The IP address (111.222.333.444) is the IP address of the server.

I have no clue where to look, because I see nothing weird in the log files. How should I troubleshoot this?

 

[zEitEr]

Hello,

Scan your PHP files (and MySQL tables) for [email protected], it might be a script, which is triggered by cron.

 

[Cybex]

Interesting, I found the e-mail address in a PHP script. I disabled the domain (unused domain anyway) and now I have to wait to see if more BF attempts pop up. Thanks for the suggestion!