I have a Linux server that's running a custom distro, I have a lot of problems with spam running through my server but I have no idea how. This is the sendmail configuration: divert(0)dnlinclude(`../m4/cf.m4')dnlOSTYPE(linux)dnldefine(`CERT_DIR', `/etc/mail/certs')define(`confCACERT_PATH', `CERT_DIR')define(`confCACERT', `CERT_DIR`'/cacert.pem')define(`confSERVER_CERT', `CERT_DIR`'/smtpcert.pem')define(`confSERVER_KEY', `CERT_DIR`'/smtpkey.pem')define(`confCLIENT_CERT', `CERT_DIR`'/smtpcert.pem')define(`confCLIENT_KEY', `CERT_DIR`'/smtpkey.pem')define(`confCRL', `/etc/ssl/crl.pem')define(`confLDAP_CLUSTER', `XXmail')define(`confLDAP_DEFAULT_SPEC',`-h localhost -bou=sendmail,ou=services,dc=XXXXXXXXXXXXXXXX,dc=XX')define(`confMAX_HEADERS_LENGTH', `32768')define(`QUEUE_DIR', `/srv/sendmail/mqueue')define(`confPRIVACY_FLAGS', `noexpn,novrfy,noverb,noetrn,authwarnings,nobodyreturn,goaway')define(`confLOG_LEVEL',`14')dnl FEATURE(`no_default_msa')dnl DAEMON_OPTIONS(`Family=inet, Port=smtp, Name=MTA')dnldnl DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, Modify=s')dnldnl DAEMON_OPTIONS(`Port=465, Name=MSA, Modify=E')dnldnl DAEMON_OPTIONS(`Port=587, Name=MSA, Modify=E')dnlEXPOSED_USER(`root')FEATURE(`nouucp', `reject')dnlFEATURE(`redirect')dnlFEATURE(`use_cw_file')dnlFEATURE(`access_db', `LDAP')dnlFEATURE(`blacklist_recipients')dnlFEATURE(`compat_check')dnlFEATURE(`nocanonify')dnlFEATURE(`virtusertable', `LDAP')dnlFEATURE(`virtuser_entire_domain')dnlFEATURE(`always_add_domain')dnlFEATURE(`genericstable', `LDAP')dnlFEATURE(`generics_entire_domain')dnlFEATURE(dcc,``F=T, T=C:30s;S:30s;R:30s;E:30s'')dnldnl FEATURE(dnsbl)dnlVIRTUSER_DOMAIN_FILE(`-o /etc/mail/virtuserdomain')dnlINPUT_MAIL_FILTER(`clamav', `S=local:/var/run/clamav/clmilter.sock, F=, T=S:4m;R:4m')dnlINPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass.sock, F=, T=C:15m;S:4m;R:4m;E:10m')dnldefine(`confINPUT_MAIL_FILTERS', `spamassassin,clamav')dnldefine(`confMILTER_MACROS_CONNECT',`b, j, _, {daemon_name}, {if_name}, {if_addr}')dnldefine(`confMILTER_MACROS_ENVRCPT',`r, v, Z')dnldefine(`confMILTER_MACROS_EOM', `{msg_id}, {mail_addr}, {rcpt_addr}, i')dnldefine(`ALIAS_FILE', `ldap:-k (&(objectClass=sendmailMTAAliasObject)(sendmailMTAKey=%0)) -v sendmailMTAAliasValue -b ou=aliases,ou=sendmail,ou=services,dc=plazapublishing,dc=se')dnldefine(`confLOCAL_MAILER', `cyrusv2')dnldnl set SASL optionsTRUST_AUTH_MECH(`PLAIN')dnldefine(`confAUTH_OPTIONS', `A p')dnldefine(`confAUTH_MECHANISMS', `PLAIN')dnlMAILER(`local')dnlMAILER(`cyrusv2')dnlMAILER(`smtp')dnlI've installed sawmill log analyzer and changed the loglevel to 14. From what I can see, the emails comes outside of the network and is sent to another person outside the network. And it seems like they don't authenticate to use the SMTP server at all. I've tried to find the vulnerability that they use myself without success.Majority of spam emails says that LOCALHOST is the relay..I've tested the server for open relay and all kinds of vulnerabilities. 
A lot of spam being sent with sendmail
linux;sendmail