Another possibility is squid (web proxy server). If you don't have squid set up to deny outsiders (this is enabled by default, but you may have inadvertently disabled it), they could spam that way. I ...