Email common path that the message was sent

[thunn]

Hello Supporters,
I got this daily message below, but the path is too general, I can't find the file which sent email out. Is there a way which can show me which .php script is sending out email?

Hello,
The xxx account has just finished sending 100 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.

After some processing of the /etc/virtual/usage/xxx.bytes file, it was found that the highest sender was [email protected], at 100 emails.

[B]The most common path that the messages were sent from is /home/xxx/domains/xxx.com/public_html/news/[/B], at 291 emails (97%).
The path value may only be of use if it's pointing to that of a User's home directory.
If the path is a system path, it likely means the email was sent through smtp rather than using a script.

This warning was generated because the 100 email threshold was hit.

The most common path that the messages were sent from is /home/xxx/domains/xxx.com/public_html/news/
=> I want the path with more detail about .php file send out mail data.

Thank you.

 

[toml]

You could always look in that path for any php or any other scripting language that might send an email. There is nothing in the message to indicate that it was a .php script. It could just as easily been a shell, perl or python script.