Hi Sebastian,

Do you mean my DNN administrative email account or the relay in the host settings?  If it is not set up does that mean I should leave it alone so these spammers can't get through my relay server? 

For those of you that may run into a similar problem, it looks like I may have stopped the attacks.  At the recommendation of my host I changed my FTP password.  According to the host there was a possibility of injection attacks. If the attackers could figure out my FTP password they could attempt to run scripts off the server.  Once I changed the password the attacks stopped.  Lesson learned...use strong passwords that have a lower case and uppercase lettter, a number, and a special character.

Update...the spam didn't stop because the FTP injection attack left files in my portals/0 folder.  I don't know if anyone is aware (I wasn't) but if you have any files with the .asp;.jpg, or .asp;.txt, or .asp; followed by anything, it is an executable file.  Windows IIS will parse the file and stop at the .asp  Lesson learned.  

The hacker even left a nice text file for me with who he was.

Here's a link: http://blog.metasploit.com/2009/12/ex...