Q:

Spam e-mail tracing

I have this issue where I receive on my server admin e-mail failure notices to a lot of e-mails that I or my hosted domains did not send. 
The machine is an Ubuntu with Plesk 11. For e-mail I use qmail, which is the standard this server has.
Every user is allowed to send e-mail based on SMTP authentication. However some e-mails did get past that. 
Here is a header from such an e-mail which I cannot trace to its origin (the pipe through which it is coming)
Received: (qmail 13781 invoked from network); 28 Apr 2014 17:15:42 +0300
Received: from XXXXXXXXXXXXXXXXX (HELO User) (XXXXXX)
  by XXXXXX with ESMTPA; 28 Apr 2014 17:15:41 +0300
Reply-To: someemail
From: someemail
Subject: some spam email subject
Date: Mon, 28 Apr 2014 16:15:41 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_00E5_01C2A75B.10F0C4E2"
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200

What I can trace from this header is that the user sent the e-mail using Outlook express and authenticating with ESMTPA. The problem is that I do not know how to trace it further. 

A:

It looks like your user has a compromised machine that is sending spam through your server.  You can probably verify this by looking in the mail logs (there will be a lot of email) or using tcpdump -n port 25 to verify the content.
It's probably worth running Spamassassin on your outbound email to prevent this sort of thing before it happens or at least detect it and alert you.

