find outgoing SPAM

Hello,
Our mail IP was twice listed on Spamhouse in XBL list on CBL lookup.
The description says it could be Mikrotik router fault but our router is safe and secured no faults or problems. Have created a firewall rule to see if any of the devices sending anything outside on port 25, results are only mail server does this. So I think one of the mail accounts is sending spam. How would a be able to identify spammy account on MDaemon? Scanned all network devices for malware and so on all good. Any advice much appreciated in advance!