See this section:
     http://netwinsite.com/surgemail/help/spam.htm#hackers

Ideally you need a sample spam message to back trace into your system to 
be 100% sure....  most places will at least give you a 'time window' 
when it occurred so you can at least examine outgoing messages in that 
time period to see if anything looks suspect.

One thing to be aware of is that back scatter could be the problem, 
although the normal settings in surgemail make that unlikely.

ChrisP.



On 25/02/2016 6:56 a.m., surgemailHIDDEN@etwinsite.com wrote:
> Today Comcast threatened to disable my Internet due to sending spam.  I looked through a number of logs, checked the outbound queue and my Surgemail has been set to not allow over 500 messages a day from a single user.  I found nothing in the outbound queue, nothing apparent from the logs and have not been informed of any significant numbers of sent mail.  It is probable that I have issues somewhere else on my network and Surgemail is not the guilty party.   I am searching/scanning everything for the culprit but have yet to find anything significant yet.
>
> Can anyone give me any ideas of what log reports to look through, how to search them and filter settings for those logs that will help me be more assured that my mail server is not involved?
>
> Thanks all!