I see in ps -aux many processes like this

mailnull 14086 0.0 0.6 8584 3088 ? S 01:21 0:00 /usr/sbin/exim -Mc 1BBe96-0003ey-Rj
mailnull 14087 0.6 0.6 8584 3088 ? S 01:21 0:00 /usr/sbin/exim -Mc 1BBe96-0003ew-RE

checking in exim_mainlog, just see "nobody". Is there anyway I can see exactly which account sending emails?

thanks

if this is cpanel, you will need to watch the web activity from WHM -> Apache Status (refresh and watch, and especially look for POST activity or scripts that might look suspicious) and then find the culprit. needs a vigilant eye ;)