If you have a bunch of spam leaving your server and it’s being sent out from a PHP script, you can easily track what folder that PHP script is in by using the following command.
grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n
This will give you a list of all folders that contain a mail script that has recently been used to send out mail. it will count the number of times each one has sent an email, and it will sort them from least to most.
facebook
twitter
LinkedIn