Exim: How to get rid of outgoing spam?

Question

linux

Good afternoon.
Spam is periodically sent from the server through clients, which are very numerous on the server (over 200 sites) due to hacking of client sites. The ISPmanager panel
is used. A hole is used in php mail and local sending via socket. Relay is disabled.
In logs
H=localhost (static.204.97.63.178.clients.your-server.de) [127.0.0.1] F= rejected RCPT : relay not permitted
H=farcrysless.ru [91.239.215.127] X=TLSv1.2:DHE -RSA-AES256-GCM-SHA384:256 F= rejected RCPT : relay not permitted
Despite the fact that it says relay is disabled, it is still sent. What rules need to be followed to disable these mailings or somehow block them?

Answer 1

Here is a fresh log through which letters pass.
H=localhost (vps2411.inrr.ru) [127.0.0.1] F= rejected RCPT : relay not permitted

Answer 2

делайте как тот же reg.ru просто кроет сайт если с него идет спам. и типа пока юзер не почистит сайт после взлома - запускать этот сайт не будут