Detect & Delete Email Spam on cPanel Server via Exim

Introduction

3 AM, my phone buzzed — monitoring system alarm. The server handling email for one of our clients suddenly had load spike 300%. Not from web traffic, not from database, but from a mail queue that had piled up with hundreds of thousands of emails. On my first check, it turned out one cPanel account had been compromised — the email password was brute-forced, and from there spam was being blasted everywhere. In less than 6 hours, the server had racked up 847,000 emails in the queue. From that experience, I learned one thing: spam is no joke. It doesn’t just slow down the server — it can get your server IP blacklisted and your legitimate emails will never reach their destination.

If you manage a cPanel server, email spam is something you’ve definitely dealt with — or will deal with. What’s frustrating is that sometimes you don’t even realize your server is spamming until someone complains “why is my email going to spam?” or until your server IP ends up on the Spamhaus blacklist. I once handled a case where a client said their proposal email never reached the customer. Turns out? The email was rejected because our server IP had been blacklisted due to undetected spam that had been running for 3 days.

In this article I’ll show you how to detect email spam on a cPanel server using Exim commands — the default mail transfer agent on virtually all cPanel servers. Every command below I’ve used many times in the field and they’re proven effective at finding compromised accounts. Let’s dive in.

Symptoms of a cPanel Server Under Spam Attack

Before getting into troubleshooting commands, it’s important to know the symptoms that indicate your server is being used for spam. From my experience, here are the most common signs:

• Server load spikes suddenly — especially on Exim processes. You can check with top or htop and look for exim or exim4 processes.
• Mail queue piles up — the number of emails in the queue keeps rising and won’t go down. Normally the queue is empty or has just a few stuck emails.
• RAM completely used up — Exim processing thousands of emails can consume massive amounts of RAM. If free -h shows used memory nearly full but you can’t tell which application is using it, check the mail queue.
• IP gets blacklisted — you can check at MXToolbox Blacklist Check. If your IP is on Spamhaus or another blacklist, there’s likely spam that got through.
• Email bounce-backs flood in — this is called a bounce-back storm. Spam is sent to invalid addresses, and destination servers send back error messages. These error messages themselves can further pile up the queue.
• Exim log file grows drastically — the Exim log file (/var/log/exim_mainlog) suddenly balloons to gigabytes within hours.

The symptoms above don’t always mean your server is under a massive attack. Sometimes just one compromised email account is enough to cause chaos. The important thing is that you know how to detect it early.

Root Cause: Why Can Emails Turn Into Spam?

Before we get into troubleshooting, let me explain why emails on a cPanel server can become spam. So you don’t just know how to fix it, but also how to prevent it.

1. Weak Email Account Password

This is the number one cause I encounter most often. Passwords like password123, yourname123, or qwerty are basically an open invitation for hackers. They use brute-force scripts that try thousands of password combinations per minute. Once they get access, they blast spam to their heart’s content until you notice.

2. Compromised PHP Scripts

Sometimes it’s not the email password that’s the problem, but a hacked PHP script on the website. This script can be used to send emails via PHP’s mail() function or through SMTP authentication. This usually happens on websites running old CMS versions or unupdated plugins.

3. Misconfigured Forwarder

A single forwarder pointing to an invalid address can cause a bounce-back storm. Email gets sent to a non-existent address, the destination server bounces it back, and this process repeats until the queue is full. I once handled a case where one forwarder to a deleted Yahoo address caused 50,000 emails stuck in the queue within 2 hours.

4. Inactive Email Accounts

Email accounts that aren’t used but are still active are a risk. Usually accounts like info@domain.com, test@domain.com, or newsletter@domain.com that were forgotten and never deleted. If the password is weak, hackers will definitely try.

Command #1: View All Emails in the Queue

The first step when you suspect spam is to view the entire mail queue. This command shows all emails waiting to be processed by Exim:

exim -bp

The output from this command looks roughly like this:

  25h  3.2K 1xP5vg-0004KQ-VA <spammer@compromi.com> user@victim.com
  24h  2.1K 1xP6Ab-0005LR-BC <spammer@compromi.com> another@somewhere.org
  23h  1.8K 1xP7Cd-0006MS-DE <spammer@compromi.com> contact@business.net
   3m  4.2K 1xQ8Ef-0007NT-FG <legit@yourserver.com> client@company.com

Each line shows:

• Column 1 (25h) — how long the email has been waiting in the queue. If there are emails waiting for days, that’s suspicious.
• Column 2 (3.2K) — email size in kilobytes.
• Column 3 (1xP5vg-0004KQ-VA) — the unique email ID in the Exim queue.
• Column 4 (<spammer@compromi.com>) — the sender address (sender/envelope sender).
• Last column (user@victim.com) — the destination address (recipient).

If you see hundreds or thousands of lines from the same sender address, that’s highly suspicious. But reading exim -bp output manually for thousands of lines is tedious and impractical. That’s why we need the next command.

Command #2: Identify the Top Email Senders in the Queue

This is the first command I always use when troubleshooting spam on a cPanel server. This command counts and sorts which email addresses are sending the most emails in the queue:

exim -bp | awk {'print $4'} | sort | uniq -c | sort -nk 1

Let’s break down this command one by one so you understand what each part does:

Breakdown of Each Part

1. exim -bp — Displays the entire mail queue. Each line contains information about one email waiting to be processed.

2. | awk {'print $4'} — Pipes the output to awk to extract column 4, which is the sender address. In exim -bp output, column 4 is the field containing the sender’s email address in angle brackets <>.

3. | sort — Sorts all sender addresses alphabetically. This is necessary for uniq to work correctly (since uniq only removes adjacent duplicates).

4. | uniq -c — Counts occurrences of each unique sender address. Output is a number followed by the email address, e.g.: 5847 <spammer@compromi.com>

5. | sort -nk 1 — Sorts the results by number (first column) numerically. So the email with the highest count appears at the bottom.

Example Output

      1 <info@yourdomain.com>
      3 <marketing@yourdomain.com>
    147 <newsletter@yourdomain.com>
   5847 <spammer@compromi.com>

From the output above, it’s crystal clear: the address spammer@compromi.com has sent 5,847 emails in the queue. This is the primary spam culprit on your server.

What to Do After Finding the Spammer?

After identifying the spammer’s address, next steps:

• Check the account’s password — change it immediately from cPanel or WHM. Don’t just change it — make sure the password is strong (minimum 16 characters, mix of uppercase, lowercase, numbers, and symbols).
• Check forwarders — sometimes there’s a forwarder pointing to an external address, and that forwarder is what’s being exploited for spam. Delete suspicious forwarders.
• Check access logs — if possible, trace which IP address logged into webmail or SMTP to send these emails. Check /var/log/exim_mainlog or cPanel access logs.
• Clear the queue — for spam emails already in the queue, you can delete them with commands I’ll explain below.

Command #3: Identify the Top Destination Addresses

Besides knowing who’s sending spam, you also need to know where the spam is being sent. This is important to determine whether your server is being used for email brute-forcing or sending spam to random addresses. Here’s the command:

exim -bp | grep -v '^[0-9]' | grep @ | awk '{print $NF}' | sort | uniq -c | sort -nk1

Let’s break this down too:

Breakdown of Each Part

1. exim -bp — Same as before, displays the mail queue contents.

2. | grep -v '^[0-9]' — Filters out lines that start with a number. In exim -bp output, lines starting with numbers are header lines containing summaries (total emails, size, etc.). We don’t need these — we only want the detail lines.

3. | grep @ — Only shows lines containing the @ character. This ensures we only process lines with email addresses, not empty lines or other formatting lines.

4. | awk '{print $NF}' — $NF is an awk variable that refers to the last field on each line. In exim -bp output, the last field is the destination email address (recipient).

5. | sort | uniq -c | sort -nk1 — Same as before: sort, count unique, sort by count.

Example Output

      2 admin@random-domain.xyz
      5 support@another-suspect.net
    312 user@victim-email.com
   2891 inbox@target-corporation.com

From this output, you can see the spam pattern. If the destination addresses are thousands of different addresses, this is likely bulk spam — mass emails sent to a list of addresses purchased or scraped from the internet. If the destinations are one or a few addresses, it could be a phishing attempt or DDoS via email.

Additional Command: Count Total Emails in Queue

Before starting cleanup, it’s important to know how big the problem is. Here’s the command to count total emails in the queue:

exim -bp | grep -c '^[0-9]'

Or the more detailed version:

exim -bp | tail -1

The last line of exim -bp usually contains a summary like: 15847 emails shelved for retry, 3246 waiting for routing.

If the count is above 1,000, you need to act fast. If it’s above 10,000, your server is in critical condition and needs immediate intervention.

SECURITY WARNING: Backup Before Deleting Spam Emails from Queue

Before we get into deleting spam emails, there’s one thing you MUST do: backup the mail queue. Why? Because deletion commands in Exim cannot be undone. Once an email is deleted from the queue, it’s gone forever. If there happen to be legitimate emails (invoices, contracts, important emails) mixed in, you won’t be able to recover them.

I’ve been through this myself: I deleted spam emails using exim -bp | awk '{print $3}' | xargs exim -Mrm without a specific filter. Turns out 23 legitimate client emails got deleted too — contract emails that had been awaited. The client was furious, and I had to explain why their contract emails disappeared. Since then, I always backup before deleting anything from the queue.

Backup Steps (MUST Be Done)

Backup the entire mail queue to a text file before doing anything:

exim -bp > /tmp/mailqueue-backup-$(date +%Y%m%d-%H%M).txt

This command saves the entire mail queue to a file like /tmp/mailqueue-backup-20240115-0823.txt. After backup, verify it succeeded by checking the file size and contents:

ls -lh /tmp/mailqueue-backup-$(date +%Y%m%d-%H%M).txt
cat /tmp/mailqueue-backup-$(date +%Y%m%d-%H%M).txt | wc -l

Verification Steps Before Deletion (MUST Be Done)

After backup, don’t delete immediately. Verify the targets first. Make sure only spam emails appear in your filtered results:

exim -bp | grep "spammer@compromi.com"

IMPORTANT: Examine the grep results. Make sure only emails from the spammer address appear. If emails from other addresses also show up (because the filter is too loose), do not run the deletion command. Use a more specific filter.

Correct filter example:

exim -bp | awk '/spammer@compromi\.com/{print $3}' | xargs exim -Mrm

Notice the backslash before the dot (\.) — this is important so the regex doesn’t incorrectly match other addresses.

What Happens WITHOUT Backup & Verification

If you run exim -bp | awk '{print $3}' | xargs exim -Mrm without a specific filter, you’ll delete ALL emails in the queue — including legitimate ones. Contract emails, invoices, notifications — all gone in one second. There’s no way to recover them.

So, always: backup → verify → then delete. Never reverse these steps.

How to Delete Spam Emails from the Queue

After identifying the culprit, it’s cleanup time. There are several ways to delete spam emails from the Exim queue, from safest to most aggressive.

Method 1: Delete by Sender

If you’ve identified the spammer’s address from Command #2, you can delete all emails from that address:

exim -bp | awk '/<spammer@compromi\.com>/{print $3}' | xargs exim -Mrm

This command:

• exim -bp | awk '/<spammer@compromi\.com>/{print $3}' — searches for all lines containing the spammer address, then extracts the email ID (column 3)
• | xargs exim -Mrm — deletes each email by its ID

Warning: Make sure you’re using the correct address. Don’t accidentally delete legitimate emails that happen to be sent from the same server.

Method 2: Delete Emails That Have Been Waiting Too Long

If you want to delete all emails that have been waiting longer than a certain time (e.g., 24 hours), use this command:

exiqgrep -z -d 24h | xargs exim -Mrm

exiqgrep is a tool for filtering the Exim queue. The -z flag selects failed (bounced) emails, and -d 24h filters emails older than 24 hours.

Method 3: Delete ALL Emails in the Queue (Nuclear Option)

This method is very aggressive and should only be used if you’re certain ALL emails in the queue are spam or no longer relevant:

exim -bp | exiqgrep -i | xargs exim -Mrm

Or the more brutal version:

for queue_id in $(exim -bp | awk '{print $3}'); do exim -Mrm $queue_id; done

Strong warning: Don’t use this method if there are legitimate emails in the queue. First backup the email list with this command before deleting:

exim -bp > /tmp/mailqueue-backup-$(date +%Y%m%d).txt

Pro Tips: Spam Prevention on cPanel Servers

1. Use strong passwords for all email accounts — minimum 16 characters. I always recommend using a password manager like Bitwarden or KeePass.
2. Enable SpamAssassin in cPanel — a built-in cPanel feature that’s very powerful for filtering spam before it reaches the inbox. Can be activated from cPanel → Email → Spam Filters.
3. Install CSF (ConfigServer Security & Firewall) — a very powerful firewall for cPanel servers. One of its features is detecting and blocking IPs performing SMTP brute force.
4. Rate limit SMTP connections — limit the number of SMTP connections per IP in Exim configuration. Can be configured from WHM → Exim Configuration Manager.
5. Disable unused email accounts — don’t let idle email accounts stay active. If they’re not being used, disable or delete them.
6. Monitor mail queue regularly — don’t wait for alarms to go off. I usually set up a cron job to alert when the email count in queue exceeds 100: exim -bp | grep -c '^[0-9]' | awk '{if ($1 > 100) print "ALERT: Mail queue high - "$1" emails"}'
7. Update CMS and plugins regularly — most email account compromises start with vulnerable PHP scripts on websites.

FAQ

How do I check if my server IP has been blacklisted?

Visit MXToolbox Blacklist Check and enter your server IP. This tool checks your IP against 80+ known blacklists including Spamhaus, SpamCop, and Barracuda. If your IP is blacklisted, it’s usually because spam was sent from your server in the last 24-72 hours.

Is it safe to delete all emails in the queue at once?

It depends on the situation. If you’re 100% certain all emails in the queue are spam, yes it’s safe. But if there are legitimate emails (e.g., invoices, customer newsletters, or transactional emails), don’t delete everything. Always backup the queue first with exim -bp > /tmp/backup.txt before performing mass deletion.

Why does spam keep appearing even after changing the password?

Possible causes: (1) there’s a compromised PHP script on the website, (2) there’s a forwarder or auto-responder still active, (3) the hacker created a new email account from the panel, or (4) there’s another application (CRM, ERP, etc.) storing old credentials and keeps trying to send. Check Exim logs at /var/log/exim_mainlog to trace the source IP of the connection.

How many emails in the queue is considered normal for a cPanel server?

For a normal shared hosting server, the mail queue should ideally be empty or under 50 emails. If the queue is consistently above 100, something needs investigation. Above 1,000 is in the urgent category. For dedicated servers handling high email volume, up to 500 might be normal, but anything beyond that warrants investigation.

Related Issues

• How to Troubleshoot High Database Load in MariaDB — often occurs alongside email spam because server load spikes
• GRUB Rescue Error After Disk Resize — accumulated spam emails can fill up the disk and cause similar errors
• Why DNS Changes Take Time to Propagate — important to understand during email migrations involving DNS MX records

Conclusion

Detecting email spam on a cPanel server isn’t as complicated as you might think, as long as you know the right commands. The two core commands you need to memorize are:

• exim -bp | awk {'print $4'} | sort | uniq -c | sort -nk 1 — to find who’s sending the most spam
• exim -bp | grep -v '^[0-9]' | grep @ | awk '{print $NF}' | sort | uniq -c | sort -nk1 — to find the top destination addresses

With these two commands, you can quickly identify compromised accounts and take appropriate action — whether that’s changing passwords, removing forwarders, or clearing spam from the queue. Most importantly, don’t wait until the problem becomes critical. Monitor the mail queue regularly and set up automated alerts when the queue starts building up. Better to prevent than to have to clean up hundreds of thousands of emails at 3 AM — trust me, I’ve been there and don’t want to go through it again.