Spamcop listed - need help to diagnose why

[David Banning]

My server just was listed with Spamcop.  Before I exercise my -one time-
option to de-list it I need to verify that indeed my server is not sending
spam. I have 3 win boxes routing through my FreeBSD box.

Also there are a few windows computers in the outside world that send
mail through my server via port 26 using their login and password.

I know it is possible for viruses to install a stand-alone smtp server
on win boxes. That is one suspicion I have.

My question;
What tool would I use to see if unauthorized mail is being sent via
my server? Note that I am running tmda, so that I have around 80 emails per
minute being sent out; to request verification on my standard incoming
mail, (therefore it is too complicated to just watch -all- mail being
sent out, and try and decode legitimate from illegitimate).