Sorry I've been quiet on this--trying different things. I don't have a spare hub lying around, but there's one *outside* the PIX, which shows me everything using Ethereal (which puts my NIC in promisc mode automatically, Greg). I can then map ports with the PIX's PAT log (show xlate) and track down traffic.

Found a LAN client which was sending spam.

But I still haven't found the major culprit. :(

Doing the unplug dance as I can.