Tracking down bad php formmail scripts

Hi:

For the second time in as many days, my root account has been bombarded 
with rejection notices for spam that's originating on our server.  It's 
not being relayed via SMTP, it's apparently being injected directly into 
the MTA by the localhost.

I've seen this in the past with various perl cgi's, but those could be 
tracked down by looking at the apache cgi or suexec logs.  In this case, 
it must be coming from a client's php script as it shows uid 80 (httpd) as 
the invoker of qmail.

The question is, how do you track down which virtual host on your server 
has the offending code, let alone the code itself?  I can see no further 
clues in the headers or global httpd error log.

TIA,

James Smallacombe		      PlantageNet, Inc. CEO and Janitor
[email protected]							    http://3.am
=========================================================================
-- 
Eat sushi frequently. - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list