How to find the web page form that sent an e-mail

We have a staging and live site for a client, and we disabled the staging site from sending e-mails but every now and then, we get one that appears to come from the staging server, but there's no forms there to be doing the e-mailing. I'm just wondering if there's a way to figure out where these e-mails are coming from because since it's a form, it's 开发者_运维知识库using the e-mail address that we programmed into the form and not the end-user's address.

Try blocking the default SMTP ports on the staging server - if that resolves the issue then you know where the fault lies.

Also, the email should have some source information in the header etc. Look at that to give you more of an idea as to where the email has originated from.

What SMTP server is installed on the staging environment? You could look at the SMTP logs and see if that server has sent out any emails. If there are no emails sent out by this server, then its not coming from that server and may be from another source.

If you find that there are e-mails being sent out by the SMTP server, you may be able to track back which server-side script invoked the SMTP server via the logs.

you could look at the internet headers to find out from what sever it originated. Rightclik on the mail in Outlook (if you're using that) and select the options.

Microsoft Mail Internet Headers Version 2.0
Received: from c.mycomp by d.mycomp with Microsoft SMTPSVC(6.0.3790.4675);
 Thu, 26 May 2011 16:19:06 +0200
Received: from e.mycomp by d.mycomp with Microsoft SMTPSVC(6.0.3790.4675);
 Thu, 26 May 2011 15:19:05 +0100
----snip----

----snip----
Received: from a.mycomp ([X.Y.Z.A])
by  a.mycomp with esmtp (Exim 4.74)
(envelope-from <no-reply@mycomp.com>)
id ; Thu, 26 May 2011 14:19:04 +0000
Received: from myserver.mycomp.com ([X.Y.Z.A] helo=Myserver)
by a.mycomp with esmtp (Exim 4.74)
(envelope-from <no-reply@mycomp.com>)
id ; Thu, 26 May 2011 14:19:04 +0000
MIME-Version: 1.0
From: "International IT Operations" <no-reply@mycomp.com>

this tells me which server orginated the mail so at least you know if it's coming from the dev box or not Received: from myserver.mycomp.com ([X.Y.Z.A] helo=Myserver)