[Exim] spammers using scripts on the server.

Sorry if this has been answered before I couldn't see anything in the
faq or past archives.

we have exim running on a webserver so a couple of websites can send
email throught the php mail function.

There seems to be some vulnerabilities with these mail scripts as our
server is being used to spam people. It doesn't currently relay for
anyone other than the local domain.

How can I only allow mails to be sent with certain domains in the from
field.

ie From: webmaster@???

Or is there a better way to prevent spammers abusing scripts located on
the server.

Thanks for your help.