Upon digging deeper, it seems that The Dude is not actually sending email. It is instead probing various POP-3 hosts, plus SMTP hosts. The case I described here is most likely an SMTP probe. I did see that in one network segment of our WAN, the systems IDS logged incoming requests for port 110. Usin...