I asked this same question in serverfault but realized that wasn't the right place, I apologize.
Server OS: Ubuntu 10.04
Mailing Application: Sendmail
Recently I asked about backscatter on a mail server running sendmail, Amazon noticed me that my server is sending junk mails to others in the form of backscatter. I later removed the sendmail's ability to receive incoming emails by stopping the daemon from listening on port 25. The message queue is still setup to run periodically. So after that my server can only send emails to outside, preventing backscatter.
After a few days I got an abuse report from Amazon, saying the exact same thing (sending spam). I immediately check the mail log on my server and found that my daemon sent out 3 emails to 2 unfortunate users at gmail.
Since I'm certain that my server can not receive any incoming emails, I believe there is some malicious scripts sitting on my server doing nasty things. Thus what are the steps that I can take to diagnose for any of these evil scripts? What logs can I check for more records, and how can I locate the scripts who sent these emails?