I found a spamer on my hosting server yesterday, I suspended the account(end user) and re-checked the log today.(/var/log/exim_mainlog) then I found out that user is still using the account and sending spam mails. When I came back to cpanel, check the end user account, can not find it, checked /etc/userdomains, nothing found. That is some kind of bug? When account was suspended and the spammer still can use the client to sending mails?