Our server blocked, need help!

Someone that uses our server (we have a total of 20 different domains and about 50 users) have sent a lot of spam from their computer. This means that our server is now blocked on several antispam organisations. Eg Spamcop.

I don't know which account that have sent all those mail, and now I would like to look at the logs to find the account.

Where do I find the logs for outgoing mail?

Can I block SMTP from one user account but not all?

Please help!

/andreas 😐