I got this daily message below, but the path is too general, I can’t find the file which sent email out. Is there a way which can show me which .php script is sending out email?
The xxx account has just finished sending 100 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
After some processing of the /etc/virtual/usage/xxx.bytes file, it was found that the highest sender was firstname.lastname@example.org, at 100 emails.
The most common path that the messages were sent from is /home/xxx/domains/xxx.com/public_html/news/, at 291 emails (97%).
The path value may only be of use if it's pointing to that of a User's home directory.
If the path is a system path, it likely means the email was sent through smtp rather than using a script.
This warning was generated because the 100 email threshold was hit.
The most common path that the messages were sent from is /home/xxx/domains/xxx.com/public_html/news/
=> I want the path with more detail about .php file send out mail data.