exim_mainlo, the following user is sending unsolicited emails:
U=user223 the system user?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
U=user223 is the user retrieved from the remote server using the
ident service. These days so few servers support
ident calls that I have disable the call in my configuration. It appears this is enabled in your configuration.
Based on the remote user, I suspect this may be a Spam message of some sort. However, this is only one of a number of factors I use.