I run a little site on a VPS (CentOS) and my own mail server (Postfix) as well.
For months, everything went smoothly, until the impossible (over confident, I know) : one of my email accounts was flooded with undelivered mail notifications. The postfix log confirmed it : thousands of mails were sent. I immediatly changed the password, but this had no effect and I am still officially a spammer
The problem is, although I managed to install and configure my server, security is a topic beyond my knowledge (I am software programmer)... so any help/tips are welcome... where do I start looking ?