Do You know any good Linux command to identiffy which script are sending most of emails out of server?

So far im using this command/can be added into script:
echo "Now wait to directories sending most mail";grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n;echo "can use grep -Ril \" mail(\" /suspicious/directory  to find mailing script"
It returns pathes and number of sent emails.

It works on Exim mailserver..