So I get this urgent work order this morning. Users mail box getting thousands of bounces. Oh no, I think, and get into his account, change the GroupWise password. (GMS is using NDS passwords for auth). It appeared to stop, then I informed the user of the new password, and it starts again. Hmm. I think Maybe his PC is infected. He shuts down, and of course he isn't even able to get his mail at this point, except via his iPhone. SO it starts again, and I thought how in the world, oh wait, he has a phone! so I changed the NDS password (he doesn't even authenticate to the tree with his PC) and block the phone in the GMS console for extra measure, and finally it stops. So the phone was doing it!! Android I assume. I am an Android fan, so I'm not hating. The reality is that Android is a more open platform. I check the console, and I was shocked. iPhone iOS 9.1! So don't let an Apple fan tell you his phone doesn't need AV!!!