spammer sending email as localhost, how to trace?

I have a spammer sending mail :

localhost[127.0.0.1] highlydemand@gawab.com

I am guessing php script, but I am wondering how I can trace it back do an account? I do not actually see gaweb.com as an account/subdomain/addon/parked domain.

Thanks for any help.

 

looks like it was found :


truthful 4273 0.2 0.1 48060 9184 ? S 08:00 0:19 /usr/bin/perl ./delivery.cgi --d=3 --del --quiet --fork

It's at /home/truthful/public_html/cgi-bin/int/delivery.cgi