we get tons of mail from "Mail Delivery System" reporting that email cannot be sent to specific mail address, because it is full. so, we think that one of our customers sends spam (bombs). we tried to look in /var/log/exim_mainlog but found only that user is "nobody" .. so spammer uses php script or etc... how to known spammers login on system?
