There is a lot of spam mail outgoing from the mail server. Is it possible to determine the domain from which they are being sent?
The mail logs should contain lines similar to:
Aug 16 11:23:33 linweb02 sender=y100124: r7G3M2Md022430: to=<EMAIL>, ctladdr=apache (48/48), delay=00:01:31, xdelay=00:00:00, mailer=relay, pri=34431, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
The sender ID(100124) in the mail log match is the webspace ID that could be found in Provider Panel > Shared Hosting Manager > Webspaces.