Not a big contributor here, but the first thing I thought when I saw the message was root kit. Granted you may have to be 'good' to root the box, or to know that it is present in the corp network. However, you did say it is forwarding mail which means it receives mail, thus it has an identifiable and locatable IP address. Also, it was stated that it was a generic RH running 2.4.18 (I think) and no hacking done to it. Is it kept up to date, current libraries etc... From what you said it sounds like a rarely thought of recipient of internet services (e-mail) or what some like to call "a target of opportunity"
Sure. And if you can 'root' that machine, you are really
good! It isn't even visible to most of the company internally!
Cheers,
Dick Johnson