From php version 5.3.0 we can use the directive mail.log to log who’s calling the function mail(). When someone calls the function mail() from a php script we can get some info about the sender in our log. I will enable logging globally. You can choose yourself where to activate it, editing your php.ini for cli, cgi, apache2, fpm… To enable it globally: sudo echo “mail.log = /var/log/phpmail.log” > /etc/php5/conf.d/mail.ini phpmail.log is the log filename used in my example. Then create the file: touch /var/log/phpmail.log chmod 777 /var/log/phpmail.log …and restart apache or process manager you are using: /etc/init.d/apache2 restart or /etc/init.d/php5-fpm restart