Server sends spam, how do I check what is spamming?

Server sends spam, how do I check what is spamming?

Recently we started with a new adminpanel, DirectAdmin. I've gotten a mail
this morning about one of domains sending spam. How do I check what is
sending it?
I've found an 'email usage' page, and there are alot of different senders,
which dont even exists (there are about 10 legit emailaccounts and alot
more are used for the spam).
I've checked /tmp, /var/tmp and /user/tmp for weird files, don't see
anything. I did top -s to see any weird processes, and psf afx to see
anything that looks odd.
The thing is im not very experienced with commandline and this type of
problem, the person who is, is on vacation. Any able to give me a push in
the right direction?
If it matters, it's a WordPress website, which I also dont have alot of
experience with (we normaly use our custom cms)
I just checked cronjobs because this seems to be a daily thing, no cronjobs



It is getting more every day, time to stop this:
Warning: 21005 emails have been sent yesterday by hfadmin Today at 00:10
Warning: 16479 emails have been sent yesterday by hfadmin 08/25/2013
Warning: 13305 emails have been sent yesterday by hfadmin 08/24/2013
Warning: 8663 emails have been sent yesterday by hfadmin 08/23/2013