How to find php script that sends mail from your linux system

We run into a problem where customers Linux vm was sending a lot of unwanted messages. In order to troubleshoot this problem we did 2 things. Instructions below are for CentOS 6 and 7 but will also work on other distributions with minor configuration changes. Option 1