The current connection over 25 port command:
watch ‘netstat -na | grep :25’
with this command, you can see the external ip that user the server to send emails.
lsof-i | grep smtp
with this command you can find the username of the spammer software