Hi I had a bit of a look on the web but can not find anything simple, how could I trace what scripts are using phpmail to send spam?

find /path/to/scripts -type f | xargs file | grep -i "PHP script" | cut -d':' -f 1 | xargs grep -ni "mail"

Unless the code to send mail uses sockets directly (in which case grep for "socket" instead of "mail"), or is stored as encoded string and eval()'d, meaning you could look for eval()s that should not be there.

If you've got PHP scripts on your system sending spam, there's a good chance your box has been compromised and should be wiped clean.