The qmail queue on my server (running Plesk on CentOS 5.2) balloons up to 120,000+ messages in the queue overnight. The messages in the queue are obviously spam.
I've cleared them out over the last day using qmHandle, but I can't determine how they are still being sent. The email address they are sent from has even been added to the qmail badmailfrom file (and I've tested through Telnet that it does indeed block email from that address), but the emails continue to flood in.
I'm almost positive that the attack is exploiting a web form from one of the domains hosted on the server. I'm fairly confident I can find a way to secure the form if I could determine which one it is. The question is, how do I determine which form the emails are coming from?