There are several things you need to consider implementing to fight spam.
Implement password policy in WHM. This will force users to create difficult password instead of a dictionary word.
Go to this location in WHM, Home »Server Configuration »Tweak Settings
now change these values
2a. Max hourly emails per domain.
2b. The percentage of email messages (above the account’s hourly maximum) to queue and retry for delivery. (Minimum: 100; Maximum: 10,000).
2c. Maximum percentage of failed or deferred messages a domain may send per hour.
2d. Number of failed or deferred messages a domain may send before protections can be triggered.
2e. Restrict outgoing SMTP to root, exim, and mailman (FKA SMTP Tweak). Prevent “nobody” from sending mail.
Also you can change the location of sendmail binary (/usr/sbin/sendmail) in system. This is used by PHP to send emails from different scripts. Also Root or any other command line tool might not be able to send emails directly without a proper user with authentication in Exim.
Setup cPHulk in WHM to stop bruteforce attacks "Home »Security Center »cPHulk Brute Force Protection".
also` Check csf LF_SCRIPT_ALERT option WARNING This option will notify you when a large amount of email is sent from a particular script on the server, helping track down spam scripts
To fix this error : ssh into the server and edit the csf configuration file
search for LF_SCRIPT_ALERT = “0″
Change the value from “0″ to “1″ to fix the issue.
Don’t forget to restart the CSF
You may also get the following error :
Check exim for extended logging (log_selector) WARNING You should enable extended exim logging to enable easier tracking potential outgoing spam issues. Add:log_selector = +arguments +subject +received_recipients
Edit the exim configuration file :
Change the value from “log_selector = +all” to the following :
log_selector = +arguments +subject +received_recipients
save and restart the CSF to get this resolved.`
CSF Settings Source Site