I have an IIS7 web server at Rackspace that is being utilized/attacked in some manner to send SPAM. I have run several variations of anti-virus and malware software on the server and cleaned anything found, but it is still happening. 

I'm leaning towards some kind of web form attack, but there are several sites on this server and I didn't create all of them, so figuring out what form(s) is being used (or even where they all are) is proving challenging. 

Does anyone know of any solution to pinpoint what script(s) might be firing off these emails? Is there any way to monitor the SMTP service with more information? I've looked at SMTP logs, but all I see are things like:

2014-02-14 06:00:52 127.0.0.1 [---server info, etc---] SMTPSVC1 [-compname-] 127.0.0.1 0 MAIL - +FROM:<--------@-------------------> 250 0 56 43 0 SMTP - - - -

In fact, there are 19,608 in about a 16 hour period in this one log file I'm looking at. But unfortunately, this doesn't seem helpful. 

If anyone could offer any insight, that'd be great!