There are a few ways to address this issue.
First of all, make sure that you are required to have an outgoing relay server. These days, it seems like the proper protocol is to force users to use their ISP's outgoing email server to send any messages. Some ISPs even block outgoing connections on port 25 for this very reason.
In your situation it sounds like the webmail portion is what was compromised. You need to have password authentication enabled but you have that as well. So what can you do?
I would recommend a software package such as CSF/LFD (Config Server Security and Firewall/Login Failure Daemon). This software looks at your logs and will flag when a threshold is met. In the servers that I run, I have it set to alert me if any more than 100 messages are sent in more than 5 minutes. This is a relatively safe number to rely upon. If a spammer wants to throttle to get around this limit they could, but there are plenty of other servers out there with weaker protocols in place.
Having caught a few accounts that do this (they were paying customers) I pulled out the TOS and it's anti-spam clause and terminated them. In your case, it would just have alerted you that their account was sending spam and then you could have them change their password. And, just so you know, the "my password was compromised" excused is one of the #1 reasons spammers will give you to try to continue using your services! Make sure you double check to ensure your customer is legitimate.
The others are right. If you are going to have customers using your server to send emails, it is very important to scan the outgoing messages just as you would the incoming ones to ensure they are legitimate. The penalties of having your server blacklisted are just too great.