If you see a lot of smtp connections or your server gets constantly in spam black lists, maybe you should check if some bot spams through your server. The are 2 cases of spamming through a box: 1)using unsecure php forms that bots abuse 2)using smtp connection from an outside client this artice is about ...
A quick and usefull command for checking if a server is under ddos is: netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n