Signs that your server is sending spam

• The mail queue grows to hundreds or thousands of messages.
• Customers report that their email is rejected or lands in spam.
• Your server’s IP address appears on a blocklist.
• Bounce messages arrive for mail your users did not send.

Spam from a hosting server almost always comes from one of two places: an email account whose password was stolen, or a hacked website with a script that sends mail.

Step 1: look at the mail queue

exim -bpc                       # number of messages in the queue
exim -bp | head -n 40           # list the oldest messages
exim -Mvh MESSAGE_ID            # show the headers of one message
exim -Mvb MESSAGE_ID            # show the body of one message

In WHM, Email > Mail Queue Manager shows the same list in the browser. Note the sender addresses, the subjects and the time the messages were created.

Step 2: check for a hacked email account

When spammers steal an email password, they log in and send through your server. Each message is logged with the account that authenticated. This command counts sent messages per logged-in account:

grep 'A=dovecot_login' /var/log/exim_mainlog | sed -n 's/.*A=dovecot_login:\([^ ]*\).*/\1/p' | sort | uniq -c | sort -n | tail

An account with a very high count, often with logins from many different countries, is the likely source. Change its password at once in cPanel, and ask the owner to check their computer for malware.

Step 3: check for a script on a website

When a PHP script sends mail, Exim records the folder it ran from as cwd=. This command counts messages by folder and shows the busiest ones:

grep 'cwd=' /var/log/exim_mainlog | grep -v '/var/spool' | awk -F'cwd=' '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n | tail

A folder such as /home/user/public_html/wp-content/uploads/2026 with many messages points straight to the script. Look in that folder for unfamiliar PHP files.

To make this easier in the future, turn on mail.add_x_header in MultiPHP INI Editor. PHP then adds an X-PHP-Originating-Script header to each message, naming the script that sent it.

Step 4: stop the source

In WHM, Server Configuration > Tweak Settings lets you limit how many messages each domain can send per hour. A sensible limit stops a hacked site from sending thousands of messages before you notice.

Step 5: clear the spam from the queue

Remove only the spam, not legitimate mail. exiqgrep selects messages by sender or recipient:

# Count messages from one sender
exiqgrep -c -f spammer@example.com

# Remove them (check the count first)
exiqgrep -i -f spammer@example.com | xargs exim -Mrm

Step 6: clean up and prevent a repeat

• ✓ Scan the site with Linux Malware Detect or ImunifyAV and remove backdoors, not only the mailer.
• ✓ Update the CMS, themes and plugins, and remove any you do not use.
• ✓ Change the passwords for the cPanel account, FTP, email and the CMS admin users.
• ✓ Check whether the server IP is on blocklists, and request removal once the spam has stopped.
• ✓ Review the anti-spam settings in our cPanel spam prevention guide.

Check the cPanel tools as well

Account owners can use Email > Track Delivery in cPanel to search for messages by sender or recipient, and see whether they were accepted, deferred or rejected. In WHM, Email > Mail Delivery Reports gives the same view for the whole server.