Show Scripts Sending email WHM

To trace php script sending email, first you will need root SSH access to server and enable log selector for exim which will help you to generate extra/well defined logs for exim.

To do this Access WHM as root. Access Service Configuration >> Exim Configuration Editor. Click on Advance Editor.

Under exim.conf section you will see #!!# cPanel Exim 4 Config
and you can add following code in the text box.

log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn  

Now checking exim logs:

tail -f /var/log/exim_mainlog | grep cwd    

Above command will grep for current working directory for exim and show the directory path from which email are being sent.

Mostly if email are sent from script then in exim logs you will see email sent form cpaneluser@serverhostname.tld

If you see there are multiple email in email queue with name cpaneluser@serverhostname.tld then you can check headers for the message.

To check email header use command

exim -Mvh Message-id  

In the header section locate for X-PHP-Script: and that will show you the exact script i.e sending email