[cobalt-users] user can *log in* to sendmail with telnet disabled

[Jale <jale@xxxxxxxxxx>]

Good day all,

I have a RAQ3i. I have telnet disabled as we only use SSH. I have one smart 
user that did:
telnet www.domain.com 25
and got into sendmail directly and could issue sendmail commands. He is 
able to sends SPAM mail using the sendmail commands without ever having 
logged on to the server.

His comment:
------------------
No. I have no access to the file system as in a standard (port 23)
telnet connection. However, connected as I am, I can send reams of spam
if I desire even though I have no account (I didn't log in) on your
server. I'll check around to see if I should be able to do this...
-----------------

Do I have something misconfigured to allow this? Any way to prevent it?

Thanks,
J.A.L.E.