Server sending Spam

[Plesk_kidv]

How do you find a php mail script that's sending out spam? The server is sending out spam but its sending from the user "nobody@servername.tld"

I can't find a way of tracing the spam messages back to a php file or domain name on the server.

Has anyone had this issue before ? Thanks

 

[Jdime]

I've also seen this.

Is there any way to add an X-PHP header or similar to messages? I saw this patch for older versions of PHP:
http://www.lancs.ac.uk/~steveb/patches/php-mail-header-patch/

Is it possible to use this with Plesk for Windows?

I saw that PHP 5.3 added the mail.add_x_header option but this isn't in 5.2

If not, can PHP be run under each user account rather than a shared nobody account similar to SuPHP?

 

[alex vargas]

I would love if someone could answer this. I also have trouble finding spammers that use some sort of mail script.