For to undestsrand when a mail as been cracked and used to send spam, i implemented a scripts that count sent email to some common domain (outlook, gmail, hotamil etc.)
When a user send too many email to this domain in last 5 minutes we receive a mail to check it and the user smtp are temporary disabled.

Actually work analising the maillog, but this method is slow and affected of some problems.

There is a way to may analyse sent mail from users in an other way ? For Example from witch arrive sent mail list that we may see in the dashboard of the admin ?

Thank you for any suggestion