Question : exchange server attempting to email random email addresses at specific domain every 2 minutes

we have an exchange server that is attempting to send emails to an external domain every 2 minutes. it is attempting to resolve random names. the external domain is rejecting these attempts with a smtp error.  i have frozen the smtp queue for the external domain. i am not able to use message tracking to find out where these email attempts are coming from. I have setup a content rule to quarantine any messages from the exchange server to this external domain. Please provide advice on how to find out what/who is attempting to send these emails. thanks

Answer : exchange server attempting to email random email addresses at specific domain every 2 minutes

your server is sending to those domains because it's trying to send its own NDR's.

some spammer out there in the world is trying to send emails to your server, by guessing addresses that don't exist.  the spammer is forging the "from" line.  

since the target email doesnt exist, your server sends an NDR to the address in the "from" line.

if the spammer claimed to be from "[email protected]" and sent to a non-existing user on your server, then your server will send an NDR to [email protected], and you'll see that in your queues