Catching A Spamming Virtual Host

I am managing few virtual domains on a server.

Recently I have seen lots of email activity. Most of the emails are being sent with php scripts which are run under apache. what I want is to catch the culprit domain

so the sender's return path in most cases is root@xxxxx as apache is running under root user.

The server runs plesk admin panel.

I know I can always inspect messages in the queue, qmhandle is good as well to do so. but is there any better way.

e.g. is there a way that instead of emails sent from php scripts with apache user domain name in return path and not root@server etc.

any tools to analyze this activity and then take necessary actions.