[joeyh]

"Someone managed to hack in by brute force anyway. I only noticed because of the _millions_ of automated replies that were coming in every day from dead email accounts or people that were out of office."

This is not a description of your email server being cracked. It's a description of someone Joe-jobbing pretending to send mail from your domain. Duckgo for mitigation techniques..

[spudlyo]

See also: backscatter

http://en.wikipedia.org/wiki/Backscatter_(e-mail)

[dredmorbius]

In fairness, there's not enough information provided to determine which this is, though my suspicion is that OP wouldn't know the difference regardless.