Preserve representative message IDs, sending identity, timestamps and authentication or script evidence. Confirm the activity is unauthorised rather than an approved campaign with a delivery fault.

1. Use Mail Delivery Reports and Mail Queue Manager to identify the responsible mailbox, cPanel user or application route.
2. Apply a targeted supported outgoing-mail restriction to the affected identity. For a compromised website, isolate the vulnerable application or account according to the incident plan.
3. Rotate exposed credentials and inspect forwarders, cron jobs, modified files and unauthorised integrations. Patch the entry point and remove persistence with a verified recovery copy available.
4. Review queued messages belonging to the incident and delete only the confirmed unwanted set. Protect unrelated customer mail.
5. Send a controlled legitimate test, restore authorised sending when containment is complete and monitor volume, failures and new suspicious activity.

The unauthorised source should stop generating messages, legitimate mail should resume under the approved limits and the queue should no longer grow from the same incident.

If abuse continues after a mailbox password change, the sender may be a local script or another credential. Do not raise hourly limits or move to a new IP merely to keep the harmful traffic flowing. Coordinate reputation remediation after the source is fixed.

Not as an initial containment step. Targeted restrictions preserve evidence and customer data while the cause is investigated. Permanent removal requires its own authorised retirement and backup process.

• Suspending a mailbox login or outgoing mail without deleting it
• Investigating a growing Exim queue in WHM
• Using the available cPanel Virus Scanner and reviewing its limits
• Adding an EasyApache PHP extension without changing every domain

• cPanel: Mail Delivery Reports
• cPanel: Mail Queue Manager
• cPanel: Manage Email Accounts