Thousands of "mail is not enabled for this user"

Question

Someone is sending my domain email to thousands of non existent mail accounts. It's like they are combining every possible prefix to my domain they know of. It's been going on for weeks. The Mail service, however, is not being brought down by this at all. So I don't know what kind of attack this is or how to stop it.
Can someone help me? Below is a minute section of my System log:
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
Dec 31 15:08:55 nameserver lmtpunix[19165]: warning: unable to post message for user: [email protected], mail is not enabled for this user
------------------

Answer 1

Two possibilities - both fall under the heading 'reconaissance by e-mail'. A spammer or hacker will try 1000's of common names, then look at which ones didn't bounce to determine which ones have accounts on your system.
They then have a comprehensive list of account names on your server, and can proceed to attempt likely passwords for each, or send endless spam to your users. Either one is a Bad Thing, doubly so if you've got any accounts that you created just to test things, and have weak passwords, but you've always counted on nobody knowing they exist.
At one point, I actually had a 'testuser' account that had 'testuser' as the password - I just hadn't remembered to delete it after I was done testing. It's very common for a system to have a couple of these hanging around. I didn't have trouble with it, but looking for and getting rid of these is critical.
Either way, the immdiate solution is to go Server Admin->Mail->Settings->Relay, and add the IP address(es) of the senders to the 'Refuse all messages from these hosts or networks' section. Mail attempts will still show up in your SMTP log, but they'll look like this one I got this morning (one of dozens):
Jan 3 11:07:33 miniserver postfix/smtpd[1440]: NOQUEUE: reject: RCPT from unknown[66.180.115.17]: 554 <unknown[66.180.115.17]>: Client host rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=SMTP helo=<xptwfs.gov>
Next is to take a look at your password policies - if you've got strong password policies (must include characters and numbers, must be 7 characters or longer, etc., you're probably OK, but if anyone has weak passwords, or god forbid, uses their userid as their password, you're pretty vulnerable.
It's also worth noting that someone with a full list of your users has a fair number of tools for improved odds of phishing, or spear-phishing, where they create finely targeted mails that say things like 'Bob Smith told me to contact you for your password', and look very real. A warning mail to your users to remind them that they need to keep passwords secret, and be cautious about mail, even if it appears to know something about them, would be good. I wouldn't specify that you've been recon'd, just a general 'New Year Security Reminder' or some such.
Hope this helps!