What is the folder /home/admin/mail/site.ru/mail login/cur?

Question

Exim

Hello.
Began to catch spammers. They send letters from my mail server.
Found one through script logging.
But still, the matter did not end there.
In the folder /home/admin/mail/site.ru/mail login/cur there is information for 2 gigabytes. What is there I do not know. Now I'm downloading it.
Question. What's in that folder? How did it get there (how to catch it)? And exim shows me the message queue, through the exim -bpc command. You have to constantly delete them.
There are suspicions that my server mail was hacked and spam is being sent from it. Changed the password. I'll see what happens next. But the issue is not closed!

Answer 1

cur - read messages
new - unread messages
tmp - temporary directory
In general, all this is the maildir of the mailbox;)
Do you read mail from this site? here, everything read by imap is placed in cur