Hello:
Just wondering if you resolved this issue? And if so how?
I have the same hack on my Plesk server, started in Jan/Feb this year - a vendor trying to send me an email noticed that Gmail was blocking email being directed to my Gmail account, the hacker scripts had been sending out 10's...