How to determine which process is sending emails on the server via sendmail?

Question

send mail

Recently through htop I saw this picture

10531 root       20   0 99532  2972  1040 S  0.0  0.0  0:07.54 `- sendmail: MTA: accepting connections
14722 root       20   0  100M  5852  2796 S  0.0  0.0  0:00.24 |  `- sendmail: MTA: ./s5B3q9To013403 mail.dhs.state.tx.us.: user open
14070 root       20   0  100M  5856  2644 S  0.0  0.0  0:01.24 |  `- sendmail: MTA: ./s5B1ul6j006077 246620674.pamx1.hotmail.com.: client greeting
13363 root       20   0  100M  5424  1948 S  0.0  0.0  0:02.70 |  `- sendmail: MTA: ./s5ANMiZH028211 mx1.hotmail.com.: client EHLO
12717 root       20   0  100M  5332  1900 S  0.0  0.0  0:03.08 |  `- sendmail: MTA: ./s5AMQhUx024729 mx3.hotmail.com.: client greeting

11 08:24:16 my_server sm -mta[14722]: s5B2xbNh009991: to=, ctladdr=< user_login1 @my_server.ru> (1017/1017), delay=01:24:39, xdelay= 00:00:03, mailer=esmtp, pri=844613, relay=mx2.hotmail.com. [65.55.33.119], dsn=4.0.0, stat=Deferred: 421 RP-001 (COL004-MC5F21) Unfortunately, some messages from XX.XX.XX.XX weren't sent. Pl...t per hour and per day. You can also refer to mail.live.com/mail/troubleshooting.aspx#errors.
As I understand it, it is sent on behalf of the user user_login1 (this user has one site on php)
I tried to cut down the site and put a ban on all files 444 - but the mailing continues.
How to determine which process is sending?

Answer 1

by elimination method.
Look at crontab, maybe there are tasks that are launched to send emails.