[Wayne R]

Deleting all of your accounts is a little extreme, but maybe not if you don't know where to start looking for these issues. The problem is, if there is an insecure script, it will just get exploited again and now you've wasted time removing & re-adding accounts.

The mail log can tell you where these emails are being sent from (/var/log/exim_mainlog), and you can then take appropriate action - whether the offender is an actual user sending spam, or if it is an exploited script. Either way, you want to stop it ASAP or your sending IP will quickly be blacklisted. You can watch the mail log in realtime, or search it for specific message IDs to get additional information on a particular email that went out.

The option is always there to purchase Premium support, which one of our techs and help you do a thorough audit and let you know exactly what is going on and why. Not really trying to sell you on it, just letting you know the option is available and may be a time/money saver for you.