I am the email administrator where I work and over the summer there has been an onslaught of phishing email specifically targeting our Windows Domain credentials. It's probably not a shock when I say that people fall for this and as such we run into times when compromised accounts are used to send spam out through our servers.

In our shop, we have two Barracuda Spam Firewall 400 series (http://www.barracuda.com). I wrote a couple of scripts to keep track of statistics for the boxes. There is a daily cron script that runs to grab the data from the previous day and dump that into a MySQL database.

I’ve linked to the source code from the two scripts below. They are both written in PHP. Enjoy!