Who or what is sending spam from my server ( CentOS / Apache / suPHP )

Summary of TroubleShooting steps

The "U=instijl" shown from your /var/log/exim/mainlog excerpt tells you that whatever is sending the emails is running as user instijl. First see if the user is logged in with a shell. Second use 'ps aux' to find if any processes are running by that user. Third, look in your apache access logs to see what traffic is being sent to apache at the exact same time as 4 mails above. I suspect you have an insecure "send me feedback" form that is being abused (insecure because you allow incoming http request to set the sender, the recipient, and the message body).

If the virtual host that is serving and accepting this request doesn't have its own access log entry, it won't log to the general access log (which is likely what you found). Find the specific section which is answering requests for that user and add the access log entry (or if it's already logging, figure out the filename). If you run 'httpd -S', apache prints out basic virtual host configuration to help you more easily find where in the config file that section is controlled/configured.

Another thing you can do is 'yum install ngrep' (may be in external repo such as epel) and run 'ngrep -n -q port 80' and see what traffic is coming in. A more specific command which only shows incoming requests would be "ngrep -q -s 240 'GET|POST' port 80". Adjust the 240 up or down if you want to see more or less of the request, or omit it if you want to see the full request.