ddockter -
first off, the message is likely held by the ESA for (re)delivery. it is almost certainly not being retransmitted through your internal gateway unless the user is manually resending the message.
in your case, connection errors (and soft bounces) will queue messages up in your destination (or delivery) queues and the system will kick off a hold down timer before redelivering (unless ofcourse you say 'delivernow').
hard bounces, as well as situations where the above scenario occurs for longer than 3 days (default unless you've specified a custom "bounce profile"), will force the message to be dropped and a bounce message generated, if applicable.
two points i can think of on dealing with this (personally i feel there's nothing wrong with dual extensions :) ):
1 - you can use a content filter on the ESA to match the same signature and drop messages, effectively avoiding this issue. perhaps by attachment name. i can try some regex's and get back to you on this one...
2 - if you don't want to do that, then here's how to dig out a message:
A) use 'tophosts' first to see whose destination the connections are failing for.
B) then use 'grep [regex] mail_logs', 'showmessage', and/or 'showrecipients' to locate the MID of the offending message
C) 'removemessage' or 'deleterecipients' to remove the actual message from the queue.
andrew
