How I can look from that script runs sendmail?

Question

my problem is that some script in php or some other script or program is sending spam.

I am not able to trace where this program runs.

do the following:

ps aux | grep sendmail
nginx    28286  0.0  0.0  39316  3328 ?        Ss   07:27   0:00 sendmail -S -t -i -fsamantha_perkins@mydomain.org
nginx    28287  0.0  0.0  39316  3352 ?        Ss   07:27   0:00 sendmail -S -t -i -fmuriel_maldonado@mydomain.org
nginx    28288  0.0  0.0  39316  3248 ?        Ss   07:27   0:00 sendmail -S -t -i -fann_owens@mydomain.org

I use Debian 8 and OpenSMTPD