Helpful tweak setting to trace spammer in exim server:
Home » Service Configuration » Exim Configuration Manager
SpamAssassin™ reject spam score threshold : 15.5
Ratelimit incoming connnections with only failed recipients : on
Log sender rates in the exim mainlog. This can be helpful for tracking problems and/or spammers. : on
Query Apache server status to determine the sender of email sent from processes running as nobody : on
Trust X-PHP-Script headers to determine the sender of email sent from processes running as nobody : on
Also please go to whm > Server Configuration » Tweak Settings
Track email origin via X-Source email headers >> should be on
Restrict outgoing SMTP to root, exim, and mailman (FKA SMTP Tweak) :: on
Prevent “nobody” from sending mail : on
onlinuxweb 