The current connection over 25 port command:
watch ‘netstat -na | grep :25’
with this command, you can see the external ip that user the server to send emails.
while true
do
lsof-i | grep smtp
sleep 10
done
with this command you can find the username of the spammer software