There are three possibilities of outgoing spamming. Compromised email account, through malicious files uploaded in CMS, open mail relay (in rare cases). if you are using cpanel, run below command:
exim -bpc and see mail queue. If its high, you can check mail IDs using exim -bp. You can take any mail ID and run below command:
exim -Mvh Email_ID
it will show header info in which you will see if sender is showing cpanel username or email account. If its email account ,immediately change it's password. If it shows cpanel user, run below command:
cat /var/log/exim_mainlog | grep /home | grep cpanel_user
It will show the folder from which the script is sending spamming.
I didn't grep /home/user because on the server there may have /home/ /home2.
Hope, it will help you to trace spammer.