Getting sick of spammers in server and IP blacklisting ?  To find the spammer account in server you need to SSH to server and run below command

awk ‘$3 ~ /^cwd/{print $3}’ /var/log/exim_mainlog | sort | uniq -c | sed “s|^ *||g” | sort -nr

This will show the the path of the user account from where max email was sent  in sorted order.

You can suspended the user and also check if any malicious file in the directory shown.