how to stop spam

i have big problem i cant stop spam email

in this photo i dont have email on server and i dont have how this email sending



how to stop it ?

Your server may not be sending them.  SMTP sends the reply to the MX assigned to a domain, even if the original spam didn't originate from your server.

The other emails are probably being sent via PHP.  Most likely your have an insecure script on your server.  If you don't use the server for email at all, you can close the ports for SMTP ( port 25 mainly ), and disable all of the mail software.

i dont have PHP script i delete all file

i change port 25 to 26
i apply this post now  https://forum.centos-webpanel.com/how-to/how-to-setup-thunderbird-and-outlook-mail-client-setup/

do you think this post will help me ?

i change port 25 to 26

There is no such thing as changing port 25 to something else. It will not matter.
No email server accepts sending to any other email server on anything other than port 25.
To close port 25, just simply block it with the firewall.

Try looking into these links:

simple info:
http://wiki.centos-webpanel.com/tracking-php-script-spam
http://wiki.centos-webpanel.com/track-spam-infected-scripts

[root@host postfix]# maldet -a /home/
Linux Malware Detect v1.6.4
            (C) 2002-2019, R-fx Networks <proj@rfxn.com>
            (C) 2019, Ryan MacDonald <ryan@rfxn.com>
This program may be freely redistributed under the terms of the GNU GPL v2

maldet(8357): {scan} signatures loaded: 17272 (14450 MD5 | 2039 HEX | 783 YARA | 0 USER)
maldet(8357): {scan} building file list for /home/, this might take awhile...
maldet(8357): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6
maldet(8357): {scan} file list completed in 1s, found 16368 files...
maldet(8357): {scan} found clamav binary at /usr/bin/clamscan, using clamav scanner engine...
maldet(8357): {scan} scan of /home/ (16368 files) in progress...

maldet(8357): {scan} scan completed on /home/: files 16368, malware hits 0, cleaned hits 0, time 101s
maldet(8357): {scan} scan report saved, to view run: maldet --report 220413-0247.8357

-------------
last email use php from 1 month

Will CWP have some updates regarding mail spam?
Some configuration tools are really missing from CWP (spamassassin level filtering, !greylisting!, email/domain blocking, sent/received mail log, etc)