spammer on the server can't find the script


Jul 16, 2008
I have done a number of things including setting up extended logging for exim and cannot find the PHP script that is sending spam mail. I can see the activity when using the "top" command, I can view the mail in the queue but the only indication I have of what is sending the mail is that the nobody user is sending it. This could be any of the accounts on the machine. Is there any way to alter the sendmail path in php.ini to pipe the output through something that can identify where these are coming from? I thought the logs would be enough, but I'm not finding enough info.