How do I track down the source of a script or user abusing a mail script to spam from a server as "nobody"?

mv /usr/sbin/sendmail /usr/sbin/sendmail.save
Create a new /usr/sbin/sendmail file with your favorite editor containing the following:
#!/usr/local/bin/perl
# use strict; use Env;
my $date = `date`;
chomp $date;
open (INFO, ">>/var/log/formmail.log") die "Failed to open file ::$!"; .
my $uid = $>;
my @info = getpwuid($uid);
if($REMOTE_ADDR) {
print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME n";
}
else {
print INFO "$date - $PWD - @infon";
}
my $mailprog = '/usr/sbin/sendmail.real';
foreach (@ARGV) { $arg="$arg" . " $_";
}
open (MAIL,"$mailprog $arg") die "cannot open $mailprog: $!n";
while ( )
{
print MAIL; }
close (INFO);
close (MAIL);
Then run these commands:
chmod +x /usr/sbin/sendmail
touch /var/log/formmail.log
chmod 666 /var/log/formmail.log
This will now log the directory the script ran from (if its from php) and the user information. The log file is globally writable so this script should not be used for long periods of time and only while you can monitor the log file. Save the new sendmail script to another file name when you are done and rename the original sendmail binary.
mv /usr/sbin/sendmail /usr/sbin/sendmail.spam.check
mv /usr/sbin/sendmail.real /usr/sbin/sendmail
Use this script at your own risk.