I don't remember where Exim keeps its logs, but I'll guess something like /var/log/exim4/ (been a long time since I used Exim, sorry)...you're going to need to roll up your sleeves and start investigating. Assuming log file name is "exim_mainlog" you could do:

more exim_mainlog (and page through the results looking for interesting things)

tail -f exim_mainlog (and just keep an eye on it for awhile, see if something pops up)

You could get a little more complicated and look for block messages, assuming it's a rogue script continuing to try to send to blacklisted IPs, but I personally try to start with a wide net when I'm not totally sure what's going on.

Any particular reason for using Exim? Most people use PostFix, so there are probably more how-to's and help for that application.

_________________
Either provide enough details for people to help, or sit back and listen to the crickets chirp.
Security thru obscurity is a myth - and really really annoying.

Thanks for the help guys. I'm using Exim because that's just what VestaCP installed automatically. I've generated some exim stats from my log files. Here is some excerpts. One of you guys might be able to understand it better than me.

Exim statistics from 2015-02-15 06:49:26 to 2015-02-26 03:25:34

Grand total summary
-------------------
                                                                  At least one address
  TOTAL               Volume   Messages Addresses     Hosts      Delayed       Failed
  Received              54MB        971                 458       7  0.7%     42  4.3%
  Delivered             84MB       1229      1245        20
  Rejects                          4247                1355
  Temp Rejects                    20181                 134

Deliveries by transport
-----------------------
                      Volume    Messages
  local_delivery        48MB         850
  local_spam_delivery   355KB          36
  remote_smtp           36MB         343

And a bit more

Top 50 mail rejection reasons by message count
----------------------------------------------
  Messages   Mail rejection reason
      1237   Dropped: too many nonmail commands
      1100   Rejected RCPT: relay not permitted
       289   Connection refused: too many connections
       116   Rejected MAIL: Access denied - Invalid HELO name (See RFC2821 4.1.3)
        83   Rejected RCPT: Unrouteable address
        79   Rejected RCPT: Sender verify failed
        15   Rejected RCPT: Rejected because 178.32.47.104 is in a black list at bl.spamcop.net
        13   SMTP protocol synchronization error
         9   Rejected RCPT: Rejected because 118.97.175.114 is in a black list at bl.spamcop.net
         7   Rejected MAIL: Helo name contains a ip address (HELO was [192.168.1.8]) and not is valid
         6   Rejected HELO/EHLO: syntactically invalid argument
         6   Rejected MAIL: Helo name contains a ip address (HELO was [192.168.1.5]) and not is valid
         5   Rejected RCPT: Rejected because 46.21.182.74 is in a black list at bl.spamcop.net
         5   Rejected RCPT: Rejected because 89.215.72.239 is in a black list at bl.spamcop.net
         4   Rejected MAIL: Helo name contains a ip address (HELO was [192.168.1.3]) and not is valid  .....

Top 50 sending hosts by message count
-------------------------------------
  Messages      Bytes    Average   Sending host
        75      578KB       7891   local
        61     5303KB       87KB   (Asus15)
        26     5087KB      196KB   server502.webhostingpad.com
        26       74KB       2914   mail2.linode.com
        13      585KB       45KB   sv2.elanceonline.com
        10      125KB       13KB   mail.elecelite.eu
         8      246KB       31KB   kjmx009.kijiji.com
         8      202KB       25KB   smtp.netregistry.net
         8       40KB       5120   a27-38.smtp-out.us-west-2.amazonses.com
         7     2056KB      294KB   pa49-183-93-104.pa.vic.optusnet.com.au
         7      483KB       69KB   nskntmtas04p.mx.bigpond.com
         7      300KB       43KB   mail-pa0-f52.google.com
         7      218KB       31KB   mail.coresoft.com.au
         7       97KB       14KB   mail-pa0-f46.google.com
         7       24KB       3510   a27-116.smtp-out.us-west-2.amazonses.com
         6      272KB       45KB   nskntmtas05p.mx.bigpond.com
         6      124KB       21KB   nschwmtas04p.mx.bigpond.com
         6       68KB       11KB   mail-pa0-f51.google.com
         6       59KB       10KB   do158-81.mailgun.net
         6       26KB       4437   a27-115.smtp-out.us-west-2.amazonses.com
         5      697KB      139KB   mail-pd0-f169.google.com
         5      138KB       28KB   mail-pd0-f181.google.com
         5      111KB       22KB   mail-pa0-f41.google.com
         5      107KB       21KB   mail-pa0-f49.google.com
         5       90KB       18KB   mail-pa0-f48.google.com
         5       72KB       14KB   nskntmtas06p.mx.bigpond.com

Top 50 local senders by message count
-------------------------------------
  Messages      Bytes    Average   Local sender
        27      451KB       17KB   Debian-exim
        25       72KB       2949   root
        21       53KB       2584   admin

Top 50 host destinations by message count
-----------------------------------------
  Messages  Addresses      Bytes    Average   Host destination
       886        886       48MB       55KB   local
       311        327       26MB       86KB   gmail-smtp-in.l.google.com
         4          4     2629KB      657KB   mx3.netregistry.net
         4          4      748KB      187KB   mx4.hotmail.com
         3          3      737KB      246KB   mx3.hotmail.com
         2          2     1998KB      999KB   mx2.hotmail.com