My zimbra mail server is spamming. I know because of the reports, from daily reports.

The thing is, its an outside account of my domain, a gmail account, i already modify zmmta.cf so it only accept sending emails from my domain, but the spam continue to go out.

I try following the logs, zimbra.log, audit.log and mail.log, but i cant see which is the user account that has been compromised.

Could somebody point me in the rigth direction to determine which user account is being used to spam, any help would be apreciate it.