TranscendLinux.com

Use the modified qmHandle's qmHandle -tt to see the top senders/recipients. Look at one of the spam messages and look at the Received line, which will either show you a UID or received from network.

If it shows you a UID, then the spam is coming from a compromised script.

pam_abl (the pam auto blacklist module) is a great way to protect against brute force attacks. It works by keeping track of failed login attempts, and blacklisting hosts (and/or users) that exceed a specified number of failed logins.