there were a few websites/users with incorrect permissions that had defaced and hacked pages allowing spam to send on one of them, making the issues.
server is running again, we've cleaned up the active spammers, and resettting permissions in users impacted by this now, I am not sure how these permissions were set yet, but looks like just 2-4 users and possibly a tech error, or doing as requested on some folders for a user so an application worked, but making for '777' type permissions on (in unix terms, on windows)