Does anyone like a mystery? Mystery "welcome" emails

[brentwilliams2]

There is a spammer that runs a bot trying to create accounts on my site. My site successfully stops the registration, so no account is ever created, but somehow a "Welcome" email still gets sent out. The problem is that creates a bunch of bogus failure emails getting bounced back, and our host is saying that is making it show our system as spamming. So they are threatening to take our email offline until we can figure it out.

Any suggestions?

Relevant notes:
1) I use JomSocial which has the domain name they use blocked. During tests, I am unable to register myself using that blocked email.
2) I have tested using the main joomla registration, but I'm using DomainRestriction plugin, and that stops it, at least during my own tests. I've also enabled captcha just in case.

[itoctopus]

Have you checked your logs to see how your website is being spammed? It might be that there is vulnerability somewhere and that vulnerability is being exploited for failed registration attempts that also send out emails.

Checking the logs helps substantially. Also, if you website doesn't send out emails then you can disable email sending completely.

[Bernard T]

Post FPA report.

I agree, investigate your access logs to collect more details about which URL's are being used for registration, and form which IP's, etc.

[Slackervaara]

From the emails bouncing back you can look in the header of the original mail and see if the senders ip-address is in it maybe. If the ip-address is identical in all mails you can ban it in .htaccess and stop this.

[Bernard T]

@Slackervaara: read the OP post again. His Joomla is the one sending out the emails.