I have a web server with 300 users. All of them have access
to Sendmail, and now one of my users have either a script with
bad security or is abusing this server to send spam.

Question is; How can I find this user? I have tried to read
/var/log/maillog and I have looked at some of the emails
in /var/spool/mqueue. The only reference I find is the
nobody@server address, which means it could be anyone.
There must be some kind of log telling me who is using
/var/lib/sendmail...? :eek:

My second problem is that Sendmail uses the nobody@server
as a default return address. Can I change this into another
postmaster account which recieve mail? I don't want
to setup a MX record and an email account for this server
only.

Any help would be appreciated. Thanks!