[ale] Hacked to spam??

[John Mills]

ALErs -

I found suspicious reports in the last few 'logwatch' reports on my 
RH-7.3 setup. The latest couple say:

=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=
 --------------------- sendmail Begin ------------------------

1011642 bytes transferred
186 messages sent

**Unmatched Entries**

iBE2IgI27139: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs
iBE2R4927161: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs
iBE2UeP27173: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs
iBE2Yri27184: Authentication-Warning: otter.localdomain: jmills owned 
process doing -bs


 ---------------------- sendmail End -------------------------
...
=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=

and:
=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=
...
 --------------------- sendmail Begin ------------------------

9038537 bytes transferred
390 messages sent
 
 ---------------------- sendmail End -------------------------
...
=-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-==-=-=-=-=

I've been seeing those "doing -bs" lines since setting up my mail service, 
but I can't account for those massive numbers of messages.

Coincidentally(?), I no longer see those bogus attempts at SSH logins 
from scripts that try all manner of ususal accounts and passwords.

I'm running 'sendmail-8.11.6-23.73' from the RH rpms, and use 
'fetchmail-5.9.0-21.7.3' to collect mail from my ISP's POP server.

What should I look for in /var/log/maillog (or elsewhere) to track this 
down?

TIA.

 - John Mills
   john.m.mills at alum.mit.edu