Thanks Stephen for the input. I have detected the hosted domain which is infected, as soon as deactivate the domain, the spam stops, as soon as activated again the spams start to try to use the mailserver (but localhost is deactivated so far).
Could you please help in locating and removing the...