I just got back home today and checked my Mercury Mail server, It seems someone was able to send mail from my account.
I have the option ticked not to allow sending of non-local mail.
I am curious how they do it? Under local users, I have several user accounts created with strong passwords apart from noreply which doesnt have a password. The local user account they are sending emails from is dion@mydomain.uk. Inside the MercuryS folder, a file was created with the following.

13:28:56.667: --- 12 Feb 2025, 13:28:56.667 ---
13:28:56.667: Accepted connection from '106.6.143.170', port 25, timeout 30 secs.
13:28:56.667: Connection from 106.6.143.170, Wed Feb 12, 13:28:56
13:28:56.667: << 220 smtp.aviandirectory.uk ESMTP server ready.<cr><lf>
13:28:56.855: >> EHLO hjoaepqvl.de<cr><lf>
13:28:56.855: << 250-smtp.aviandirectory.uk Hello hjoaepqvl.de; ESMTPs are:<cr><lf>
13:28:56.855: << 250-TIME<cr><lf>
13:28:56.870: << 250-SIZE<cr><lf>
13:28:56.870: << 250-STARTTLS<cr><lf>
13:28:56.870: << 250 HELP<cr><lf>
13:28:57.277: >> MAIL FROM:dion@aviandirectory.uk<cr><lf>
13:28:57.293: << 250 Sender OK - send RCPTs.<cr><lf>
13:28:57.480: >> RCPT TO:3932006329@qq.com<cr><lf>
13:28:57.480: << 250 Recipient OK - send RCPT or DATA.<cr><lf>
13:28:57.668: >> DATA<cr><lf>
13:28:57.668: << 354 OK, send data, end with CRLF.CRLF<cr><lf>
13:28:57.851: >> Message-ID: 000301db7d95$02883745$0004daf2@aviandirectory.uk<cr><lf>
13:28:57.851: >> Return-Path: 3846577052@qq.com<cr><lf>
13:28:57.851: >> Reply-To: 3993378394@qq.com<cr><lf>
13:28:57.851: >> From: =?utf-8?B?5pWR5Yqp6YCa6L+H5Y+R5pS+ICAyMToyODo1Ng==?= dion@aviandirectory.uk<cr><lf>
13:28:57.851: >> To: 3932006329 3932006329@qq.com<cr><lf>
13:28:57.851: >> Subject: =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.851: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.851: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.867: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?=<cr><lf>
13:28:57.871: >> =?utf-8?B?ICAgICAgIA0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN?=<cr><lf>
13:28:57.871: >> =?utf-8?B?Cg0K44GJ?=<cr><lf>
13:28:57.871: >> Date: Wed, 12 Feb 2025 21:28:56 +0800<cr><lf>
13:28:57.871: >> MIME-Version: 1.0<cr><lf>
13:28:57.871: >> Content-Type: multipart/mixed;<cr><lf>
13:28:57.871: >> boundary="----=_NextPart_000_0001_ED20652D.0DE5D9D8"<cr><lf>
13:28:57.871: >> X-Priority: 3<cr><lf>
13:28:57.886: >> X-MSMail-Priority: Normal<cr><lf>
13:28:57.886: >> X-Mailer: Microsoft Outlook Express 6.00.2900.2180<cr><lf>
13:28:57.886: >> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180<cr><lf>
13:28:57.886: >> <cr><lf>
13:28:57.886: >> This is a multi-part message in MIME format.<cr><lf>
13:28:57.886: >> <cr><lf>
13:28:57.886: >> ------=_NextPart_000_0001_ED20652D.0DE5D9D8<cr><lf>
13:28:57.886: >> Content-Type: text/html;<cr><lf>
13:28:57.886: >> charset="utf-8"<cr><lf>
13:28:57.886: >> Content-Transfer-Encoding: quoted-printable<cr><lf>
13:28:57.886: >> <cr><lf>
13:28:57.886: >> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">=0D=0A<HTML><=<cr><lf>
13:28:57.886: >> HEAD>=0D=0A<META content=3D"text/html; charset=3Dutf-8" http-equiv=3DConten=<cr><lf>
13:28:57.886: >> t-Type>=0D=0A<META name=3DGENERATOR content=3D"MSHTML 11.00.10570.1001"></H=<cr><lf>
13:28:57.886: >> EAD>=0D=0A<BODY>=0D=0A<DIV><BR> </DIV>=0D=0A<DIV style=3D"POSITION: re=<cr><lf>
13:28:57.886: >> lative">=0D=0A<STYLE>body{font-family:Arial,sans-serif;text-align:center;ba=<cr><lf>
13:28:57.886: >> ckground-color:#f0f0f0;margin:0;padding:20px;}.image-container{width:600px;=<cr><lf>
13:28:57.886: >> height:400px;background-image:url(https://a1.qpic.cn/psc?/V53eiZq42XmRHz1Gb=<cr><lf>
13:28:57.886: >> fR54FMwFM1trMZ1/IoAt0TAZs8Yc38Jr9jGXIT1cmlpNmqqP0FP21rM63UKIt*c7ML1Sljpffgd=<cr><lf>
13:28:57.886: >> XjYjNvO7WepProHVXa4gdRfFPjg!!/b&ek=3D1&kp=3D1&pt=3D0&bo=3D.gHtAfoB7QEWADA!&=<cr><lf>
13:28:57.886: >> tl=3D1&tm=3D1739361600&dis_t=3D1739364241&dis_k=3Dc85f672051017aeced499f964=<cr><lf>
13:28:57.886: >> c97fe88&sce=3D0-12-12&rf=3Dviewer_311);background-size:cover;background-pos=<cr><lf>
13:28:57.886: >> ition:center;margin:0 auto;border:2px solid #ccc;box-shadow:2px 2px 12px rg=<cr><lf>
13:28:57.886: >> ba(0,0,0,.1);}</STYLE>=0D=0A=0D=0A<H1><BR> </H1></DIV>=0D=0A<DIV class=<cr><lf>
13:28:57.886: >> =3Dimage-container =0D=0Astyle=3D"HEIGHT: 493px; WIDTH: 505px"></DIV></BODY=<cr><lf>
13:28:57.886: >> ></HTML>=0D=0A<cr><lf>
13:28:57.886: >> ------=_NextPart_000_0001_ED20652D.0DE5D9D8<cr><lf>
13:28:57.886: >> Content-Type: audio/mpeg;<cr><lf>
13:28:57.902: >> name="KTmMgg.mp3"<cr><lf>
13:28:57.902: >> Content-Transfer-Encoding: base64<cr><lf>
13:28:57.902: >> Content-Disposition: attachment;<cr><lf>
13:28:57.902: >> filename="KTmMgg.mp3"<cr><lf>
13:28:57.902: >> <cr><lf>
13:28:57.902: >> 5YWr5pyI5Y2B5Zub5pel5L2Z5Y2n55eF5Y2a5bGx5a+65Lit<cr><lf>
13:28:57.902: >> ------=_NextPart_000_0001_ED20652D.0DE5D9D8--<cr><lf>
13:28:57.902: >> <cr><lf>
13:28:57.902: >> .<cr><lf>
13:28:57.902: << 250 Data received OK.<cr><lf>
13:28:58.386: >> QUIT<cr><lf>
13:28:58.386: << 221 smtp.aviandirectory.uk Service closing channel.<cr><lf>
13:28:58.386: --- Connection closed at 12 Feb 2025, 13:28:58.386. ---
13:28:58.386:

Please start by confirming that relay settings in MercuryS configuration are strict:

I only had the top one ticked and I never created the auth.mer file. I have now created the file, added username password to each line for each member and ticked all the boxes. I restarted the server and now I will need to wait for a few days and see if it helps.
I was scratching my head trying to figure out how they did it. Thank you

I forgot to ask, the file auth.mer, do the passwords need to be the same as the passwords for each user in the PASSWD.PM file? or can they be different. I kept them the same for simplicity

heh, it seems to have fixed the issue :-)
Someone already tried a few moments ago and failed...

16:16:07.974: --- 12 Feb 2025, 16:16:07.974 ---
16:16:08.050: Accepted connection from '165.154.227.2', port 25, timeout 30 secs.
16:16:08.074: Connection from 165.154.227.2, Wed Feb 12, 16:16:08
16:16:08.074: << 220 smtp.aviandirectory.uk ESMTP server ready.<cr><lf>
16:16:08.290: >> EHLO smtp.aviandirectory.uk<cr><lf>
16:16:08.316: << 250-smtp.aviandirectory.uk Hello smtp.aviandirectory.uk; ESMTPs are:<cr><lf>
16:16:08.316: << 250-TIME<cr><lf>
16:16:08.316: << 250-SIZE<cr><lf>
16:16:08.316: << 250-AUTH CRAM-MD5 LOGIN PLAIN<cr><lf>
16:16:08.316: << 250-AUTH=LOGIN<cr><lf>
16:16:08.332: << 250-STARTTLS<cr><lf>
16:16:08.332: << 250 HELP<cr><lf>
16:16:09.038: >> RSET<cr><lf>
16:16:09.044: << 250 Command processed OK.<cr><lf>
16:16:09.254: >> MAIL FROM:nkttjgefza@aviandirectory.uk<cr><lf>
16:16:09.276: << 250 Sender OK - send RCPTs.<cr><lf>
16:16:09.488: >> RCPT TO:validxxxg@gmail.com<cr><lf>
16:16:09.488: << 553 We do not relay without RFC2554 authentication.<cr><lf>
16:16:09.707: >>
16:16:09.707: --- Connection closed at 12 Feb 2025, 16:16:09.707. ---
16:16:09.707:

Great!

Yes, auth.mer passwords can be the same as in passwd.pm if you prefer that, and assuming they are reasonably secure.

It seems there is another problem now, when new members try to register, they do not get the conformation email.

My mailer settings are as follows...

    // Set default variables for all new objects
    public $SMTPDebug = 2;
    public $From     = 'noreply@aviandirectory.uk';
    public $FromName = 'Avian Directory';
    public $Host     = 'smtp.aviandirectory.uk';
    public $Mailer   = 'smtp';
    public $SMTPAuth = true;
    public $Username = 'SiteAdmin';
    public $Password = 'PASSWORD'; //if using Gmail use an app password more details here https://support.google.com/accounts/answer/185833?hl=en
    public $SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
    public $Port = 587;
    public $WordWrap = 75;
    public $AuthType = 'CRAM-MD5';

The issue being reported in MercuryS is...

05:26:05.129: --- 13 Feb 2025, 5:26:05.129 ---
05:26:05.131: Accepted connection from '89.240.5.180', port 587, timeout 30 secs.
05:26:05.131: Connection from 89.240.5.180, Thu Feb 13, 05:26:05
05:208:28:45.191: --- 13 Feb 2025, 8:28:45.191 ---
08:28:45.207: Accepted connection from '89.240.5.180', port 587, timeout 30 secs.
08:28:45.222: Connection from 89.240.5.180, Thu Feb 13, 08:28:45
08:28:45.222: << 220 smtp.aviandirectory.uk ESMTP server ready.<cr><lf>
08:28:45.222: >> EHLO www.aviandirectory.uk<cr><lf>
08:28:45.222: << 250-smtp.aviandirectory.uk Hello www.aviandirectory.uk; ESMTPs are:<cr><lf>
08:28:45.222: << 250-TIME<cr><lf>
08:28:45.222: << 250-SIZE<cr><lf>
08:28:45.222: << 250-AUTH CRAM-MD5 LOGIN PLAIN<cr><lf>
08:28:45.222: << 250-AUTH=LOGIN<cr><lf>
08:28:45.222: << 250-STARTTLS<cr><lf>
08:28:45.222: << 250 HELP<cr><lf>
08:28:45.285: >> STARTTLS<cr><lf>
08:28:45.285: << 220 OK, begin SSL/TLS negotiation now.<cr><lf>
08:28:46.519: [] SSL/TLS session established
08:28:46.519: [] TLS_AES_256_GCM_SHA384, TLSv1.3, Kx=any, Au=any, Enc=AESGCM(256), Mac=AEAD<lf>
08:28:46.519: [*] No peer certificate presented.
08:28:46.519: >> EHLO www.aviandirectory.uk<cr><lf>
08:28:46.519: << 250-smtp.aviandirectory.uk Hello www.aviandirectory.uk; ESMTPs are:<cr><lf>
08:28:46.519: << 250-TIME<cr><lf>
08:28:46.519: << 250-SIZE<cr><lf>
08:28:46.519: << 250-AUTH CRAM-MD5 LOGIN PLAIN<cr><lf>
08:28:46.519: << 250-AUTH=LOGIN<cr><lf>
08:28:46.519: << 250 HELP<cr><lf>
08:28:46.566: >> AUTH CRAM-MD5<cr><lf>
08:28:46.566: << 334 PDU5NjM3NzM0LjExMjgxQGF2aWFuZGlyZWN0b3J5LnVrPg==<cr><lf>
08:28:46.566: >> U2l0ZUFkbWluIDk0ZDE3MWFmNTk5N2IwNTQ0ODY0ZjE0Mzk4MGNjMzJk<cr><lf>
08:28:46.566: << 501 Authentication failed - bad user or password.<cr><lf>
08:28:46.566: >> QUIT<cr><lf>
08:28:46.566: << 221 smtp.aviandirectory.uk Service closing channel.<cr><lf>
08:28:46.597: [!] Warning [Benign]: SSL connection improperly closed by remote host.
08:28:46.597: --- Connection closed at 13 Feb 2025, 8:28:46.597. ---
08:28:46.597:

OK I finally fixed it..... at last!
In the password, I was using the character £ and it was causing all the issues. For anyone having a similar issue to this topic, please check the characters you are using in your passwords to make sure they are not conflicting with the server.

Big thanks to Rolf Lindby on this site, and Synchro who is from PHPMailer on GitHub. Without your brilliant support I would never have got this working. Thanks guys.