How to detect if PHP Script is Sending out Spam on a Server

Let’s assume your server is sending out lots of spam and it runs Exim 4 MTA. How do you find the script causing all the spam?

Check one of the emails it sends for the X-PHP-Script header. This header will usually contain the name of the script sending the mail. From there it is easy to find the spamming script.