IMAP4 breakin attempt

[blubomber]

While going through some event logs, i noticed on my exchange 5.5 server running on win2k, there was a 13003 event that is an attmept to log onto the exchange server through IMAP4. i got the IP address and traced it back to germany. I just did not get any specifics about what user name or password was used. Is there anyway to get this info? I checked through the exchange transaction logs but it did not have anything.

Also, i am using Microsoft ISA Server 2000 as my firewall/proxy server. It did not pickup anything either.

[gothic]

Might be someone looking for this:

http://packetstormsecurity.nl/filedesc/MDaemon.txt.html