Exim has just been set for Extended Logging to show script names in the header - so the next occurance will show more info - should be on Tuesday going by the last few weeks.
The last header does say - Received: from unknown."myhost".com (unknown."myhost".com [myip]) by rly-dc09.mx.aol.com (v119.12) with ESMTP id MAILRELAYINDC091-b3d4713721b394; Mon, 15 Oct 2007 09:58:51 -0400
The "myhost" and "myip" is the part that incriminates me as the spam source. I assume that ESMTP means it was sent using smtp, correct?
According to tech support on my host, "Top 50 Sending Hosts means the ISP of the user on your server that is sending." Since the only place on my site where users can send email (that I am aware of) is the "Email Post" feature - that prompted my original question.
I have repeatedly scoured my files looking for one that does not belong that may be sending email but can't find one.
Maybe next week's spamcop report will reveal more...
