Your queue is growing as would be expected when you stop Exim. Usage seems to be quite low with a few messages at about 5 in the morning when cron often runs daily jobs. Usage is also heavy early in the evening.
Even if the service is stopped, it is commonly called by running the program and submitting the messages. Normally, this call would deliver the mail immediately, or queue the message for later delivery. This is likely what you are seeing. As messages are queueing, it is likely that the some (all) destinations can not be reached.
PHP and other languages have modules for sending emails. These usually default to using the local server. Normally, there are options that can be set to specify a different host to be used.
You can see where the mail is coming from by looking at Exim's log file. This is often /var/log/exim/mainlog
. The details there should show where the messages are coming from, and to whom they were sent.
The command sudo mailq
should show all the messages and who they have been sent too. There are options to display the headers and contents of messages in the queue. Look for the options beginning -Mv
in the man page.
Normally, you want a mail server running, although you may not want it listening on any public addresses. crontab
and other programs use email to send notifications to their users. The default configuration can be tuned anywhere from a local server with local delivery to a full fledged Internet MX.