finding a spammer relaying through sendmail

[David Banning]

I have around 40 email users on my system,  and one seems have had their 
login info stolen.  Is there a way to determine which user is being given
authorization to relay through sendmail? I have increased sendmail logging
to 15 but the sender is flagged only as an email address, one unknwon to me.

Any pointers would be helpful.