Spammer getting into the tmp dir. Need help.

[flamesburn]

So ive got a spammer getting perl scripts into the /tmp/ dir.

The directory is secured, however he is still getting it in.

im running commands like

cd /usr/local/apache/domlogs/
grep "enviador.txt" ./* | more

to search for what script has the vulnerability, but searches are comming up empty.

Any idea where I should search next to see which script hes getting into tmp via?

[Infopro]

I'd suggest this one.
http://cplicensing.net/scripts.php#chkphpbbver