the best way is to make a suppout.rif and send it to email@example.com
, they can see inside and tell you what is wrong.
I think he did that but now he is expecting an immediate reply, and that is not the service provided at that address.
Well, when in despair and wanting a solution NOW, I suggest to make a full /export and download it, examine it closely for any strange or unknown things and remove those,
then netinstall the device and reset it to blank (no defaults) and load the /exported file again (using connection via MAC address from a local winbox).
When that solves it, the device had been compromised and a close look at the firewall rules is warranted.