I have a Linux server running Exim. Some user is sending spam. I can tell this because almost every 24 hours I'm getting a huge number of undelivered mail in the nobody account.
I can see how the Exim queue quickly grows and, until now, I had to restart the server for the flood to stop.
I've tried using ps and top to identify the account that is generating the spam but I guess it's through a php script and it is being ran as nobody.
How could I trace the offending account / script ?