How to identify the script that's sending spam from my server?

So, this is what I wanna know. How do I identify the script that is sending spam from my server?. Server is using exim. Maldet scanning did not help much. Any advises ?