A customer support email box, hosted on Exchange was filling up with messages. A couple a minute for the past 4 days. We have a few Time Warner Road Runner mailboxes setup to forward from one to another, then eventually to an Exchange server. The Scan mailbox forwards to Support, which forwards to the external Exchange support address. The Exchange support mailbox was receiving Delivery Status Notification Failure messages and Undeliverable Attached Image messages a few times a minute. For the past 4 days.
No matter what I did, they kept coming. Shutting down the mail server on the sending MTA didn't even stop them. That was odd. Examining the receiving Exchange Logs only showed one record for each item for the day, however the receiving mailbox was filling up with these messages. The messages were almost identical, the headers seemed accurate, but they didn't change much.
Looking closely at the headers showed only the last 2 mail servers were updating the header. The original handoff from the client's IP address to Time Warner's servers was not changing. Further investigation found the forward rules for both the Scan and Support addresses were set to Forward and keep. Both mailboxes were full. Deleting all messages from both mailboxes solved the problem.
The message was somehow kept in Time Warner's queue, and kept attempting to deliver the mail through the forwards. Even though the mailbox was full, the forwarded message was received by the end Exchange mailbox. However, the Time Warner or RR servers didn't get an acceptance of the forward, since they wouldn't fit in the receiving RR mailbox. They waited a what I believe was a minute and retried sending the message, which of course did the same thing. What a loop.