mail spam help

[joximu]

well - then you may have a look some lines before this entry to see if it was a connection from "outer space" or localhost.

And then - if localhost (or local ip) - you may need to find out which website...

you also may have a look at the content of the mail - in /var/spool/postfix/deferred/c/.... number...
or "defer" instead of deferred... I don't know by heart.. (one is content the other place stores the headers)

Sometimes the content also helps to find the origin....

/J