tracing emails with sendmail

[David Banning]

All of a sudden I am getting a ton of spam being relayed through sendmail.
I have around 40 legitimate users on the system - even though I have increased 
sendmail's log level to 15 - I cannot see - who is being authorized to relay 
through my server.  It gives the sender name as an eail address, unknown to me.

I am guessing that one of my users has had their passowrd stolen. Is there s
specific log level that tells which username is being given authorization
to relay?

Any pointers would be helpful.