pop before smtp and spammers

[dvdpa]

Hi

A domain I host is using alot of outbound smtp bandwidth as displayed on the plesk cp. I have the server set up as pop before smtp. As a precaution I changed all their passwords
yesterday. Today however their use is still very high. They say they are not sending the kind of email I am seeing 1.2 gb in day or so.

Any ideas how to track down?

Thanks

Chuck

RHEL3 PLESK 7.5.4

 

[Cranky]

Does it look like they are sending it via the maillog, or is Plesk making a mistake?

 

[dvdpa]

Cranky

Their site is the only one in plesk showing this abnormal
activity. What is the best way to search? grep username?
grep domain?

/usr/local/psa/var.log/maillog looks to be the log location


Is there a tool or script that is helpful?

Thanks

Chuck