How to Trace Who was Using my Mail Relay on Spamming?

Solution 1:

Get the message ID and grep on it.

For example, in the line below, the message ID is F05911DBCA.

Apr 16 06:29:12 mail.xxx.com postfix/qmgr[25497]: F05911DBCA: removed

So you can execute

$ grep F05911DBCA /var/log/maillog

It will list all postfix log lines about this message, so you can check all steps done by Postfix for this specific connection.

Also, grep for sasl_username to get the user account sending the message. You can use "wc - l" command to get some count about how many times a account authenticated to send emails.

Figuring out what account was compromised, you can lock it out from sending emails.