Well you would have to look at the source of the email. I am not familiar with Exchange servers all that much. I am sure a call to Microsoft would net some gains.
But the only way a spammer could do what you say is if they hacked the password. If they did that then you got some issues. Change the Sys Admin's password right away. See if that resovles anything. Also take the Sys Admin's PC off the network for a couple of hours and run it thru the Osiris Guide.
http://www.tech-forums.net/pc/f51/sp...osiris-165828/
This will let you know if it is the Sys Admin's PC that is infected and really doing this. If not then they have access to the Exchange Server.