Long ago I think it was 2006, I worked in a computer store/corporate it support that used to also be a 56k dial up isp. When i first got hired it was supposed to be like a paid internship. 2 weeks in the guy "mentoring" me was fired. Only other employees was the owner was had a PhD in information technology from 1984 and never kept up and his wife who did the accounting.

Over the next year he hired and fired probably 15 people and then decided he liked me enough to make me full time. He had no idea what he was doing and neither did I. Basically I was responsible for 8 business networks(including a 150 employee credit union), any computers a customer brought in, and our own internal network.

One day it was slow so I was browsing various web comics. The owner comes on at 1030(we opened at 900) furious with me. He claimed I was "reading a page with black text on a white background" which meant I was reading how to operate a spam business. That was his proof, a page with black text and a white background which he could not find my history.

He had received a letter from his isp that we were sending 2.5 million emails a day, we had 72 hours to resolve the issue or we were to be cut off. I argued that I didn't run a spam operation, he had no proof and there were simpler explanations. It got so heated I quit, keep in mind I was only employee.

Next day the credit union was having a server issue and he had no one to fix it. He called me asking for me to return, I negotiated a $1 hour raise, an official written letter of apology, pay for time the previous day and that day and told him I would be back the following day.

I went in, solved the server issue(eventually found out cleaning crew was unplugging the power strip to plug in their vaccum over night and the server was configured not to restart when power returned). Went back to the office and talked with the owner. He showed me the letter and it identified 2 ip addresses as being the source. Neither was my computer and I didn't recognize them. There was a command you could send over the terminal to open the CD tray based on ip address. I ran the command and basically walked around looking for a computer with open CD trays.

Turns out there was 2 servers, outside of our firewall directly facing the internet and yes for the memes they were originally dns servers from the 56k isp days. They were running original nt4, completely unpatched, with no security software installed and permanent outside facing ip addresses. I ran a virus scanner on it, I stopped when it detected over 100k infected files. Disconnected the servers, waited 10 minutes, called isp and effectively all email had stopped (the boss and myself both sent 1 email to confirm it was still working).