Which of the following should the administrator check for FIRST?

An administrator notices that a PC is sending an unusual amount of email at odd times of the day. Which of the following should the administrator check for FIRST?

A.
A S/MIME buffer overflow

B.
A POP3 protocol exception

C.
DNS poisoning

D.
A SMTP open relay