I have the same problem. SPAM emails are being sent from my WordPress website. My hosting company reported that those spams were sent trough these php files:
/home/bacaure/public_html/wp-comments-post.php
/home/bacaure/public_html/Authenication1.php
/home/bacaure/public_html/wp-login.php
/home/bacaure/public_html/auto.php
/home/bacaure/public_html/wp-mail.php
/home/bacaure/public_html/no6.php
