Email worm sending through wordpress site

I’m pretty new to wordpress and was looking for some assistance on how our wordpress site is getting taken advantage of by some sort of email worm or virus. We currently use Exchange for email in our environment and a 3rd party outbound filtering service so we are fortunate that this virus or worm is not getting us blacklisted. We noticed that our webserver is relaying bogus emails throughout the day, it really isnt a ton of messages, seems like only 10 a minute or so but they are bogus accounts not on our system. We eventually narrowed it down to the wordpress site and as soon as we stop the site all the emails stop. I even went in and changed the email settings within teh word press site but that doesnt have any effect on the mail going out because we allow relaying from only specific ip’s and this is one. How can i trouble shoot the site itself to see which part has been compromised by this worm in order to get rid of it? any assistance is appreciated!