Sunny,

The reason it was tagged as good is because the message was Authenticated by a user. Since this message is coming from the Internet (IP is 27.97.230.58), I have a feeling someone has cracked a user id/password on your server. Check SMTPConversation.log ( or SMTPProxyConversation.log if you're using Proxy Server and check if SMTP Authentication was used. If yes, who is the user?

Is this a brand new domain or an existing domain with new Xeams? I ask because is it very unlikely someone would crack a user/id password for a new domain.

I would recommend contacting our support department via email/phone so we can further investigate this issue.