I provide virtual hosting for a number of websites (mainly wordpress) maintained by others. Unfortunately one of them gets compromised and used to send spam (typically from a PHP script) from time-to-time.
I would like to be able to associate sites to emails sent so I can monitor mail volumes. This can be via an injected header or a log file or something similar.
PHP has an option "mail.add_x_header" which allows it to inject the name of the script being run to generate an email, but this appears to be an on/off option only, and only includes the relative path and filename being called.
Is there any way to extend PHP's functionality in a similar vain to include in the email header the name of the virtualhost or full path to the calling script, or otherwise provide some kind of log I can use to better control email sent through the server without having to make changes at the application level ?