How to find the script on Plesk server that is sending SPAM as www-data user

I am running a Plesk 9.0.1 Web Server on Ubuntu 6.06.2 LTS and have about 100 small to medium web sites hosted on the server. The problem is that I believe one of the websites has a script that is allowing spam to be sent through the server. The reason I believe this is that I get 1000s of messages an our deferred in the mail queue that show to be sent from the www-data user.

My question is if someone can tell me how to find the script or scripts that is sending the SPAM?

Thanks in advance for your help.
Who is Participating?
Take a look at the Plesk KB article:

You will need to determine where the spam is originating. If it is a user, then frequent SMTP access can often pinpoint the user.  

If is a web script, then you will see emails coming from the nobody user and you can use this technique:
Kamran ArshadIT AssociateCommented:

Is it a windows or Linux box?
mcmincAuthor Commented:
It is a Linux Ubuntu 6.06.2 LTS machine
mcmincAuthor Commented:
Does anyone have any ideas on what I can try?
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.