From php version 5.3.0 we can use the directive mail.log to log who’s calling the function mail(). When someone calls the function mail() from a php script we can get some info about the sender in our log.
I will enable logging globally. You can choose yourself where to activate it, editing your php.ini for cli, cgi, apache2, fpm…
To enable it globally:
sudo echo “mail.log = /var/log/phpmail.log” > /etc/php5/conf.d/mail.ini
phpmail.log is the log filename used in my example. Then create the file:
touch /var/log/phpmail.log
chmod 777 /var/log/phpmail.log
…and restart apache or process manager you are using:
/etc/init.d/apache2 restart
or
/etc/init.d/php5-fpm restart