Don't delete the outbound mail queue as they have a header in them which tells you which php script sent them. Also in the httpd logs look for POST 200's to sc

Don't delete the outbound mail queue as they have a header in them which tells you which php script sent them. Also in the httpd logs look for POST 200's to scripts that shouldn't be getting them, and look for long query strings esp with base64 in them. Check those scripts and also scripts messed with by the same user-agent and ip's. Never just delete anything, always check the contents and write a script that can search and nuke it en masse. e.g. Find | xargs | sed etc. When I had issues earlier this year I had postfix outbound throttled right down, and a script to shut it down completely if the queue got big. So if I got the monitoring email about smtp going down I'd know I'd missed something ;) Ps, wp-cli, you need it in your life :)