6. A PC with access to the email database has been compromised. I think this is the most likely case and don't see how whereisglenn can say "nor have we been hacked". Hackers prefer to keep a low profile so how would they know? Firewalls only stop malware being pushed to machines, they do nothing to stop luser from accidentaly pulling malware to their local PC. Can Hell Pizza honestly say that they don't have a staff member with low or modest computer skills that is using IE on a machine which does not have updates turned on? Maybe a laptop brought in from home?

It is this last case that annoys me because of the denial and refusal to sort the problem. Pity we don't have effective laws or procedures to deal with these people. In one case I was under attack from an Internet cafe where the operator told me they couldn't fix the problem since the machines were used but the public and therefore could not be secured. He had a change of heart when I offered to remotely fix the problem for him by formatting his hard drives using the same security hole he was refusing to fix.