Question
There is a lot of spam mail outgoing from the mail server. Is it possible to determine the domain from which they are being sent?
Answer
The mail logs should contain lines similar to:
Aug 16 11:23:33 linweb02 sender=y100124[22430]: r7G3M2Md022430: to=<EMAIL>, ctladdr=apache (48/48), delay=00:01:31, xdelay=00:00:00, mailer=relay, pri=34431, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
The sender ID(100124) in the mail log match is the webspace ID that could be found in Provider Panel > Shared Hosting Manager > Webspaces.