Spam from localhost

one of my servers start sending spam, not many like 10 or 20 a day

Debian 7.11
Plesk Version 12.0.18
Qmail
With mailman and localhost 127.0.0.1 in whitelist

this is the fact:
- spam has sent with different domain hosted in the server
- sometime mail sender is real mail box but some time is an existent alias with non existent mailbox
- sendmail-wrapper is inconspicuous
- doublechecked php scripts, nothing

this is header of those mail

Spam from localhost