I'm assuming that the
bind.php file is not actually a part of Joomla, but rather a malicious script that the hacker uploaded to your site. In particular, just looking at the request parameters, it appears likely that the script is being used to send e-mail spam, possibly using someone else's hijacked e-mail account.
Here's what the request parameters in your log entry look like, after percent-decoding:
po are probably short for "host" and "port";
mx01.1and1.es appears to be the hostname of a mail server in Germany, belonging to a Spanish ISP, and 25 is the standard port for SMTP. So the spammer is telling the script to connect to this mail server over SMTP to send the e-mail.
This is clearly an e-mail address; I'm guessing it's the address that the spam is to be sent from.
These look like a username ("login") and a (quite easily guessable) password. I haven't tried connecting to the mail server indicated above using this username and password, but I wouldn't be surprised if they worked. Someone should probably tell whoever owns this account that their password has been compromised and is being used by spammers.
(Update: I contacted the company's webmaster via their online contact form and reported this issue to them, before realizing that the original question was actually posted a year ago, and that the issue has presumably long since been resolved. Anyway, better to be safe than sorry, I guess...)
I'm guessing this is the address that the spam is to be sent to;
mt probably stands for "mail to".
This is likely the "full name" to be shown as the name of the sender of the message.
I'm not 100% sure what these are, but I suspect they're (bogus) original information to be provided to the mail server. The parameter
eh may be short for
EHLO ("extended hello"), an SMTP command that takes the sender's (claimed) mail server name as a parameter. (The server will record this information in the message's headers.) The IP address in the
sd parameter appears to be that of a server in Italy; I haven't tried connecting to it.
I've no idea what these parameters are, but apparently they're optional.
This might be the number of times to retry sending the message, before giving up.
This clearly indicates the character set (UTF-8) of the message to be sent.
Again, I have no idea what these parameters might be.
These are obviously the subject and body of the spam e-mail to be sent. The weird-looking Unicode text is barely recognizable as spelling out "VIAGRA SALE"; the random accents and obscure look-alike characters are meant to fool spam filters, which might otherwise trigger on words like "Viagra".
You will want to remove this script from your servers ASAP, thoroughly disinfect and reinstall your entire Joomla installation and anything else you may have running on the same server, and change all your passwords and other access credentials. If you used any of the same passwords elsewhere, make sure to change those too and assume that those other accounts have also been compromised until proven otherwise.
Ps. Googling for "joomla bind.php" turned up this forum post, which seems to confirm my guesses above. This is definitely a spam relay script.