Prevent PHP Mail() from sending mails from identified emails

Hello

We have been facing alot of email spam issues and have been following logs to suspend/notify customers about email spamming from their account.

We are looking for the following optimizations on our server to prevent compromised code to even generate email - here are the questions:

1) Is there a way to prevent/block emails that being sent using php mail function if "to" email account is already created in cPanel - idea is to block all such request where unidentified emails are being used to send out spam.

2) Any way to let PHP mail function send emails to email accounts existing within cPanel? - this is way if a contact form uses php mail, we will ask user to and from email that exist in cPanel.

I am aware that we can block php mail functions entirely and use SMTP for the mails, this is going to break alot of end user codes and will be a mess at this time for us - so we are trying to find around other solutions that can help us prevent spam.

3) What is the best practices being used by web hosting providers here? Do they keep php mail functions enabled? If yes, what are the best precautions to be followed.

Thanks in advance for the help - looking forward to hear back.