I don't know if ORFilter itself is a spam agent or if the spammers have learned how to take advantage of it.  Within 48 hours of installing ORFilter I noticed a significant increase in bounced email coming back to my server.  If I look at the IIS status I see spammer servers are attaching to my server for long periods of time.  A normal mail server will connect, deliver the message and disconnect.    I've disabled the relay on the server.  I only set it for the 127.0.0.1.  So either ORFilter is a spam agent or spammers know how to trick it into relaying email.

Fred

Things are working better now.  It looks like this badmail has been going on for a while.  Some spammer(s) were just dumping emails on my server with the right domain name, but bad user names.  I set the "spambox" address in the orconfig.xml to my mailbox.  So I started receiving emails for all these bad user names. 

I've adjusted the handling parameters which has helped.  Also, I've enabled the dropconnection for the blacklist. Then identified the IP's that are persistently trying to connect to my server and blacklisted them.

I guess it bothers me to use an unsupported program that has no source code available.  Though, I'd prefer not to spend a lot of money for my home network.