How did this get through?

[hede]

Am Wed, 26 Mar 2014 11:01:55 -0400 schrieb "Carpenter, Troy" <troy at carpenter.cx>:

>   The only difference I see between this and normal relay probing is that 
> the connect line implies the hacker (spammer) was actually authorized:

Yes, that's quite uncommon. Especially if there are not hundreds of other connection attempts from this IP.

i.e. there are no other lines with:
connect from unknown[attackerIP]

regards,
hede