Issue some help with qmail

[panos]

Hi im trying to find how my server is used for sending spam but im getting out of luck

the spam messages are invoked from network

--------------------------------------------------------------------------------------------------------------------------
Received: (qmail 11302 invoked from network); 23 Feb 2017 19:53:09 +0200
Received: from unknown (HELO Frank) (213.183.58.58)
by myactualdomain.com with ESMTPA; 23 Feb 2017 19:50:15 +0200
From: "Mr Yusin Doo" <[email protected]>
Subject: Agent Needed...
To: [email protected]
Content-Type: multipart/mixed; boundary="j6UpWpFl9NsKPEyNDK=_kAMjdsHBAxPUh70"
MIME-Version: 1.0
Reply-To: [email protected]
Date: Thu, 23 Feb 2017 17:50:14 +0000
-----------------------------------------------------------------------------------------------------------------------------

i changed all the user passwords (3-4 times already ) but somehow they can still send mail from my server,

plesk is configured as closed relay but it seems like its acting as an open one !

nothing on white list
and i cant find any php scripts that send the emails

this happens every now and then and i get thousend of mails in my queue and im getting blacklisted and my real emails are not getting delivered

please any help would be appreciated thanks !

 

[femotvaff]

you need a good systemist !
Probably you have malware in some place, but few information to help you sorry.

 

[panos]

the rootkit scanner that comes with plesk show nothing strange what info sould i post to help you help me

 

[panos]

ok back again !

qmail is stoped
no mail users on the server
mail function is disabled from plesk
port 25 and 587 blocked

and still on my plesk mail queue ( marked as not processed because qmail is stopped ) i get spam mails like this every mail from a different ip address

Received: (qmail 13300 invoked from network); 25 Sep 2017 09:16:49 +0300
Received: from unknown (HELO outlook.com) (197.234.101.58)
by mydomain.com with ESMTPSA (DHE-RSA-AES256-SHA encrypted, authenticated); 25 Sep 2017 09:16:35 +0300
Message-ID: <[email protected]>
From: "Express Pharmacy" <[email protected]>
To: <[email protected]>,
<[email protected]>,
<[email protected]>,
<[email protected]>,
<[email protected]>,
<[email protected]>,
<[email protected]>
Subject: You can make it all! We will take care of it.
Date: Mon, 25 Sep 2017 09:15:48 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_1AB5_01D335DE.E022B860"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 15.4.3538.513
X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3538.513



where should i look to any help ?