Looks like ceres.etla.org has been sending spam out for a few days. As far as I can tell someone cracked my SMTP AUTH password. Investigating.