Most outbound spam on shared servers comes from one compromised website, not from a bad customer. The damage is shared: when your IP lands on a blocklist, every customer on it loses deliverability.
Set hard limits
- In WHM » Tweak Settings, set Max hourly emails per domain to a value your busiest legitimate customer will not reach.
- Enable Track the origin of messages sent through the mail server so the sending script is logged.
- Publish SPF and DKIM for every domain, then start DMARC at p=none and tighten later.
Look at the queue
$ exim -bpc
$ exim -bp | exiqsumm | sort -n | tailA queue with thousands of messages from one domain is almost always a hacked form or plugin. Suspend outbound mail for that account, clean the site, then re-enable.
Automate it
Manual checks catch the first incident. Automatic caps and alerts catch the second one at 3 a.m.
MailGuard
See details Outbound spam limiter and sender reputation dashboard