First, look at the headers to see where the message originated. If it didn't originate from your VPS or mail server, you're probably okay. You should google an

First, look at the headers to see where the message originated. If it didn't originate from your VPS or mail server, you're probably okay. You should google and implement SPF and DKIM for your domain. SPF is just a DNS change that says what hosts are allowed to send email for your domain, and DKIM is a DNS + mailserver change that will sign legit outbound email with a key that MTAs can verify to make sure that the email is legit (and bounce it if it's not). That will stop the vast majority of fraudulent email in its tracks. Looking at the email you provided: Received: from __MY_USERNAME__ by __MY_WEBSITE__.com with local (Exim 4.80.1) X-PHP-Script: __MY_WEBSITE__.com/ for 127.0.0.1 I'd bet good money that you have a compromised or vulnerable mailer script on your machine somewhere and it's being exploited in an automated fashion. Check all of your mailers for known vulnerabilities and patches. It may be wise to assume that the box is compromised, save your known good data and code, torch the whole thing and rebuild it piece by piece, validating the pieces as you go. That's extreme, but when dealing with a potential machine breach, you can't really ever be sure that you're clean without nuking it from orbit.