[CentOS] find out which website is used for sending email?

Peter Peltonen wrote:
> I got a report that my CentOS 5.4 is used for sending spam.
>
> >From sendmail maillog I can see that apache has been sending a lot of
> email to suspicious addresses.
>
> Probably one of the many Apache virtual hosts I have is used for
> sending spam. But how to find out which one?
>   

the maillog should show where the messages are coming from