If you suspect your server is being used for spam and has vulnerable php scripts, you can follow the directions here to determine what scripts are being abused.

http://kb.sp.parallels.com/en/1711