[exim] re spamming

Hi,
i have a web hosting user which is showing overused bandwidth inhis
control panel, but whenever we analyse his mainlog for exim or
rejectlog for exim we don't see that much activity for emails from his
domain what do you thick could be the problem.

plzz help

Regards