Suspicious mail activity identified by Proxmox Mail Gateway’s tracking center.
In looking at the Proxmox Mail Gateway's (PMG) Tracking Center I became alarmed that it appeared that emails were being exchanged between users (I thought the issue was from my roundcube web mail as each email addressee matched an entry in the contacts part of Roundcube). Those emails were not sent by me nor were any received by me. I began looking for the cause and shutdown webmail. I cloned the containers. I brought non-webmail back up and began more investigation. I also noted that the dates in PMG tracking were one day off. I looked at the /var/log/maillog on both the mail gateway and my mail server. I could not find any lines matching those sent and received emails. I looked at /var/log/authlog too with no success. I then…