My best guess would be that either someone guessed an email user’s password, or that a malicious user or bot broke into a website on your server.
You may want to review the headers of some of the emails in the queue there for clues as to what user is generating them. You should be able to use that to determine whether it’s an email user, or whether it’s coming from the Virtual Server owner (which would likely indicate that a website was broken into).
Thanks a bunch Eric! I did look at the headers but at that moment I did not see anything special with it. And I emptied the entire queue because I thought I just let a couple messages come in and then I’ll stop postfix to do some debugging, however since I emptied the queue and restarted postfix, there are no new spam mails coming in :S So I have nothing to look at anymore.
As soon as new spam comes in I’ll make sure to take a look at the header. What fields should give me a clue?
Do you btw have an example postfix main.cf which should be really safe and works with virtualmin user setup?
Because I modified the config a couple of times to optimize security and I do understand that the rules should be different for every setup. However, for a simple virtualmin setup with a Wordpress website on it. Do you have a simple example config?