When managing a cPanel or WHM server, an unpatched WordPress plugin or compromised mailbox will occasionally flood Exim with thousands of spam emails.
Here is a collection of essential Exim CLI forensics one-liners to locate the root cause and clean the queue fast.
1. Identify Top Sender Addresses in the Queue
To see which email addresses currently have the highest number of pending messages in the spool:
exim -bpr | grep -Eo "<[^ ]*@[^ ]*>" | sort | uniq -c | sort -n2. Trace Which PHP Scripts Are Sending Email
If spam is originating from an injected web shell or form exploit, inspect exim_mainlog for working directories (cwd):
sed -ne "s|$(date +%F).*cwd=\(/home[^ ]*\).*$||p" /var/log/exim_mainlog | sort | uniq -c | awk '{printf "%05d %s\n",$1,$2}' | sort3. Identify Top Authenticated Mailbox Senders (Dovecot)
To see which authenticated user accounts have submitted messages today:
perl -lsne '/$today.* \[([0-9.]+)\]:.+dovecot_(?:login|plain):([^\s]+).* for (.*)/ and $sender{$2}{r}+=scalar (split / /,$3) and $sender{$2}{i}{$1}=1; END {foreach $sender(keys %sender){printf"Recip=%05d Hosts=%03d Auth=%s\n",$sender{$sender}{r},scalar (keys %{$sender{$sender}{i}}),$sender;}}' -- -today=$(date +%F) /var/log/exim_mainlog | sort4. Bulk Purge Spam Messages from a Specific User/Auth ID
Once you identify the compromised account, remove all their pending spool files without clearing legitimate client mail:
find /var/spool/exim/input -name "*-H" -exec grep -q "-auth_id AUTHID" {} \; -print | while read MSG; do exim -Mrm $(basename ${MSG%-H}); done