Restrictions and logging...

Recently we have had problems with user accounts on our server being hacked, tons of spam email being sent, and subsequently getting our server blacklisted.

I want to accomplish two things:

1. I want a log of every outgoing message being sent by our server. Don't need or want the content, only the time, date, sender, recipient and basic message information. Currently we are not getting this logging as far I know.

2. I want to restrict users from sending any mail with a return address on it other than their authorized login email. No spoofing of emails.

What is the best way to accomplish these goals?