From what I see, you run some website/s on the same server as you run iRedMail and you have somewhere badly configured/infected PHP script. This script is sending those emails via the local iRedMail server.

I would suggest to investigate you webserver logs and/or DocumentRoots of all locally hosted web domains, find the script sending the spam and fix it/remove it from you DocumentRoot.

If your server sends a lot of spam, it should be easy to see the corresponding hits in the apache access.log

This is kind of hint, first of all look for a PHP script named as noted in the email:

X-PHP-Originating-Script: 1009:7c32.php(1) : eval()'d code

The only thing you can do now is to check the blacklists and in case you'll get listed, immediately request delisting with reason "compromised account/problem fixed"

Directly was affected only files accessible via this FTP account, but theoretically the attacker could upload a PHP script modifying also other files. But this seems to be "only" dumb spam bot...

For better security when running PHP, consider adding disable_functions (to disable dangerous and usually not usefull functions like exec, eval, ...) and open_basedir (to rectrict access for file manipulating functions like fwrite only to listed folders. Just note you have to add also paths for PHP shared libraries like Zend Framework, PEAR as this directive restrict also include/require) in your virtual configs/php.ini

Good luck with your problem!

Thanks for replies.

I have one more question, when I type

mailq

I still have some spam emails pending to send, how can I remove them?