Spam being sent directly through server - can't enable SMTP Tweak

[monkey64]

I keep reveiving email alerts from LFD about LOCALRELAY and a particular account.

When I viewed details for the email in Mail > Mail Delivery Reports, it showed that the Transport was "remote_smpt".
So does that indicate that a connection was made directly to the server or was it sent via the user's email account? I have attached the output.

I read the excellent Cpanel docs on preventing email abuse but can't enable the "Restrict outgoing SMTP to root, exim, and mailman (FKA SMTP Tweak)" setting. I understand that this may not be possible with all VPS machines because they don't all have the required IP Tables.

Aggh. What should I do?

 

[quietFinn]

"Sender IP: 127.0.0.1" and "Authentication: localuser" tells that email is sent by a user in your server.
In this case "SMTP tweak" will not help.

If you get alerts from CSF/LFD it's usually even able to tell what script is used to send.

 

[cPanelMichael]

Hello

You can try searching for the recipient address in /var/log/exim_mainlog to see if any more information is available. EX:

exigrep user@domain /var/log/exim_mainlog

Thank you.

 

[monkey64]

The email was being sent through the user's default mail account; there were no email addresses set up.

It looks as though the user had installed a Wordpress Mailing script, or the Wordpress install itself was compromised.
Since the user does not use an email address related to their domain, I have set the Monthly Bandwidth Limit (MB) to 1MB in an atempt to prevent emails being sent. Is there an easier way to disable the user's default mail account?

 

[cPanelMichael]

Typically, if you have confirmed the account that SPAM is coming from, the next step is to suspend the account and advise the user to secure their scripts or stop sending out the SPAM email. One option that may be helpful is "Scan outgoing messages for spam and reject based on SpamAssassin® internal spam_score setting" found under the "SpamAssassin Options" tab in "WHM Home » Service Configuration » Exim Configuration Manager".

Thank you.