Tracking down spammers on your server

[Edem]

I have someone using a script to spam yahoo accounts, I've had to disable user nobody to stop the outgoing spam however that's not a solution. I've no idea how I can track them down I've quickly looked through accounts for suspicious files but I didn't really see anything that said I don't really know what to look for in the first place.

anyone know how I can find the user who's doing this?

[kernow]

http://www.configserver.com/cp/exploit.html

[chirpy]

You can also start by enabling extended exim logging and tracking emails through your exim_mainlog so long as they not sending directly through port 25:
http://www.configserver.com/free/spammers.html#outbound

[Edem]

Thank you chirpy after tailing the mail log for 8 hours waiting for him he finaly started mailing people again.