My server is sending spam. What do I do?

If your server is sending spam, most likely you've already ended up on an RBL blacklist.
The first thing you need to do is to find out who is spamming and stop them.

There are several ways they could be sending spam:
- they've figured out an email password and are sending remotely
- they are sending from a script on the server (insecure script)
- they've created a cronjob to send emails in the background

1) Make sure that you have a send limit enabled

echo 200 > /etc/virtual/limit

This will put a daily cap on the number of emails a DA user can send.  This is the sum of all their email account's' sends totaled together.
http://help.directadmin.com/item.php?id=81

This also requires that you've got the latest version of the /etc/exim.pl
2) Check /etc/virtual/usage to see which User has a higher-than-average bytes log.  If any User stands out, then they're likely it.

3) If you have the latest exim.pl, and DA 1.41.1 or newer, you should be able to log into DA as that User, and go to:
User Level -> E-Mail Accounts -> E-Mail Usage

which will give you a better breakdown of who is sending what, and to where.

4) Go to:
Admin Level -> Mail Queue Admin

If spam is being sent, there are usually going to be messages stuck in the Queue.
Click one of these messages (the ID) and check the contents (to ensure it's spam), and the headers of the messages to try and get info about who sent it (IP), where it's going, and if there are any  X-PHP-Originating-Script headers, telling you wish script did the sending.

5) Check to see if there are any repeated smpt-auth values:

cd /var/log/exim
grep 'A=login:' mainlog* | less

although, step 3 above should tell you what login was used, if one was used.

6) Check your exim logs for anything out of the ordinary:
http://help.directadmin.com/item.php?id=151

7) Although not related to the prevention of sending spam, if you use DKIM with your email sends, it will both lower your spam score on remote boxes as it will confirm that your emails are indeed from your server, and not spoofed from elsewhere.
http://www.directadmin.com/features.php?id=1189

8) Newer setups should have php-mail.log files, to log all php sends using the mail() function.   Check the log:

/home/username/.php/php-mail.log

How to Delete Old Email from Exim Mail Queue

Exim mail queue is one of the most important things to monitor in the hosting server. Web server with many shared hosting has more possibility to produce a huge numbers of emails in the Exim mail queue. And if you read those messages especially the old one, you will realize that most of them are junk or spam bouncing emails.
I did have the same problem and I had followed many suggestions to handle this problem including tweak the Exim configuration. Although Exim is supposed to delete email which more than 7 days old, sometimes for unknown reasons you still can find so many older mail left in your Exim mail queue.
Exim will try to resend those emails for certain periods. Too many mails in queue can take a lot of cpu resources, so you need to maintain the numbers of messages in your Exim mail queue.
Here is the manual but effective way to clean up the old messages in you Exim mail queue:

• Login to your server as a root user.
• Run the following command:
  exiqgrep -o 86400 -i | xargs exim -Mrm

The above command will delete the messages older than 1 day. To delete email more than one day you can multiply with the number of days with 86400.
Depends on how many messages in your Exim mail queue, this command may take a while to complete. If for some reason you find a locking error then your server might just in the middle of trying to resend process of those emails. Take a few moments before you try again.