[exim] Tracing Web Form Spam

Just wondering - what is a good way to put information from the apache
web server into an Exim header so that I can figure out what web form
has been hacked to send out spam.

Thanks in advance