1) I run qmHandle -R and see all the messages in the outbound queue. Message 509845 looks like it could be spam from the title.
2) I run qmHandle -m509845 to read the contents and see it is indeed spam.
3) The headers are forged. I cannot see any user account information in the message that lets me know which, if any, of my users logged on to send this.
So how do I determine what (if any) user account was the one that logged on and sent that message? I've never needed to find anything like this before so I have no idea how it would be in the system logs or where to look.