How to check that an Android device isn't being used in a botnet / sending spam emails?
I suggest using the Android VPN feature to route all of your network traffic to an OpenVPN server. This will send all traffic, Wifi and cellular, through one chokepoint where you can log and analyze it, and it will do so regardless of what network the phone is using. Then you can log and analyze traffic from the OpenVPN server using any of the standard tools.

For an example of a project that uses this approach for a different sort of network security analysis, namely to find apps that send data over unencrypted or insecurely-encrypted connections, see nogotofail.