find what php script is spamming

````
find /path/to/scripts -type f | xargs file | grep -i "PHP script" | cut -d':' -f 1 | xargs grep -ni "mail"

````

Unless the code to send mail uses sockets directly (in which case grep for "socket" instead of "mail"), or is stored as encoded string and eval()'d, meaning you could look for eval()s that should not be there.

If you've got PHP scripts on your system sending spam, there's a good chance your box has been compromised and should be wiped clean.