Check /var/log/mailog, if spam from user with sasl submitted, then you need change email password
if you think spam from phpmailer, you can try install "sendmail-wrapper" you can control over phpmail rate and have different log file.
Or if email not used, disable it completely..