Track origin of spam sent from server
I looked at the raw source of the mail, I see what user sent it to exim.
I would like to know how can I find out if it was sent from a smtp account or thru an unsecure form.
I know the user and he did not send the spam... there are no form script on his site either. So either it's a spyware on his pc that's sending it? or it someone could have stolen his login id?
