We are using IPCop 2.0.3 on our server to provide firewall/NAT for our local network. Behind IPCop we also have our own mailserver but recently we can't send any email to Gmail because Gmail's smtp blocks every email stating that it is receiving too much emails from our IP. All emails sent to Gmail are bounced with explanation:
Our system has detected an unusual rate of 550-5.7.1 unsolicited mail originating from your IP address. To protect our 550-5.7.1 users from spam, mail sent from your IP address has been blocked. 550-5.7.1 Please visit http://www.google.com/mail/help/bulk_mail.html to review 550 5.7.1 our Bulk Email Senders Guidelines.
Because our mailserver's logs report quite a low amount of emails being sent to Gmail (max 10 per day) we are suspecting that we have an infected computer somewhere on our LAN that is sending emails to gmail and because of that gmail is blocking our IP. All computers on our LAN are connecting to internet via IPCop and have 192.168.0.x addresses.
How can we diagnose this on IPCop? Is it possible to monitor/log outgoing requests to port 25 (smtp) so we can see if there is any computer that is sending out a lot of emails? We don't want to block whole port 25 on IPcop because users on our LAN also use other mailservers for their other accounts and it will block them too. We just want to diagnose if there is any computer on LAN that is sending a huge amount of emails to Gmail mailservers.