how to spot a spammer on a server ?

The most important file to check is :

Quote from: exim main log

/var/log/exim_mainlog

There you will find all information about exim operation status.

These are also useful command to get stats about exim queue:

To list email summaries and counts by domain:

#exim -bp | exiqsumm

To clear emails older than one day:

#exiqgrep -o 86400 -i | xargs exim -Mrm

To delete emails from queue FOR a particular user:

#exiqgrep -ir email@domain.com | xargs exim -Mrm

To delete emails from queue FOR a particular domain:

#exiqgrep -ir @domain.com | xargs exim -Mrm

To delete emails from queue FROM a particular user:

#exiqgrep -if email@domain.com | xargs exim -Mrm

To delete emails from queue FROM a particular domain:

#exiqgrep -if @domain.com | xargs exim -Mrm