Spamming in server

I can see a lot of spam emails being sent out from one of our servers, but I am not able to find out the email user which is being used for SMTP authentication. From the headers of the spam emails, I can understand that one of my customers' computer is infected with virus and is sending out spam emails. I can see the IPs of a local ISP in the header, however, blocking the IP does not work as it seems he does not have a static IP as the IP changes everytime. What is the best way to find out which email account is being used for sending spam from the server?

 

I could find the domain from which the spamming was happening by enabling Extended logging in cpanel.