User IP address's should be in access logs.
those who misuse software that connects to ports many years ago would use programs like mirc, etc
/server host domain port 25
/quote helo
funbrunette@xnations.com
please note that i will not post the method and mailling order of sequence that will abuse such software.
DON'T think bad thoughts, i am only knowledable and never would abuse such methods.
One thing to try to stop this would be change the server mail port.
I can only suggest that the server admin should be contacted FB. This is a serious issue that needs to be addressed.