Sounds like it is possibly an automated script or agent doing most of this work ...

		hatly22 11 months ago \| parent \| context \| favorite \| on: We got hit by an alarmingly well-prepared phish sp... Sounds like it is possibly an automated script or agent doing most of this work accessing the VPN and SMTP server. Really shouldnt have any open mail servers anywhere.