qmail script abuse

[zonem0nkey]

I believe someone or some script out there is abusing a email script that I have in one of my sites. I only have about a few email forms available on my site, but even after deleting and removing them, I'm seeing this script show up in my /usr/local/psa/var/log/maillog everytime.

1) I've turned off smtp relay via plesk.
2) I read some where that the maillog tells you the smtp messages that are being sent/received locally, is this correct?
3) Is there anything I can to find out which script/page is being abused?

 

[ZaNaToS]

check /var/tmp and /tmp/ for "suspect" files... some times they upload scripts there.
also do you have any open source cms or forums? they use to have some components with security wholes that users use to send emails.

 

[lvalics]

If they are comming via an Open SOurce Software, or Contact forms (usually this are used for sending mails), use mod_security and add mail injection rule to config.
http://www.securephpwiki.com/index.php/Email_Injection

This article will help a lot ...