Logon User Column in Event Log - ORF Forums

@hagop.nalbandian: Unfortunately, in Exchange 2007 and newer versions, ORF is no longer able to log the username of the compromised account which is used by a spammer to relay emails to external recipients. Exchange will only tell ORF whether the session is authenticated or not. This is because it is not the user which is authenticated, but the session itself (so ORF will log "Authenticated session, type: organization." instead of the actual user name used for the authentication).

I recommend checking the Exchange Delivery Reports for the destination addresses of these outgoing spam emails, which should indicate the user name of the compromised account (I think):

http://blogs.technet.com/b/exchange/archive/2010/01/13/3409181.aspx
http://howdouc.blogspot.hu/2010/08/user-message-delivery-reports-in.html

To prevent user accounts from being compromised you should

* enforce a strong password policy (i.e., passwords should be long, should include uppercase and lowercase characters, special characters, numbers, etc. and should be changed often)
* make sure you do not have active "test" accounts in your system with weak passwords (like "test", "123456", etc.)
* secure the server and clients with up-to-date resident anti-virus and other security software which prevent passwords from leaking out via keyloggers, Trojans, worms, etc.