535 invalid authentication data, not consisten

[Lyttek]

User reported sending of email stopped working this morning. I've been testing and have narrowed it down only slightly.

User has Embarq as an ISP. email address is john@domain.com

Various exim logs show the same thing: 535 invalid authentication data

I've reset, deleted, recreated the account on two different machine using three different email programs within their office, all with the same result.

Setting up the email address at my office, on AT&T it works fine.

Manually tested using the following commands:

telnet mail.domain.com 587
ehlo
auth login
(base64 encoded email)
(base64 encoded password)

At this point, on my machine I get an 'authentication succeeded' message. On the non working systems, this is where the 535 message arrives.

It does not seem to matter what email address/password I use for authentication... they all fail.

The only difference I've seen so far is the non-working system is Windows XP SP2 and mine is SP3. Given that they've been working up until today, I find it hard to believe that matters.

Thoughts?

[Lyttek]

As another test, I just ran a putty tunnel from local 587 to remote 26 where I'm running another copy of exim.

When going through the tunnel, it works fine. This leads me to believe that Embarq is somehow munging the login info...

Anyone concur/disagree?

[Lyttek]

Is there a way to see exactly what characters are being passed by the ISP? I think the encoded data is being manipulated...

I've even spoken to a "lead tech" who kept bringing up Exchange...

#$^@^@^@$#!!!!