OK typical advice starts with checking the e-mail logs on the server. Lots of folks can't find anything out of the ordinary.

Then suggested check of the server logs, looking for unauthorized access.

Then one suggests that firewall logs be checked for traffic that is bypassing the server itself.

Here's a possibility for those that "can't find anything" out of the oridinary, based on that this type of outgoing might be seen as ordinary ....

Web Contact Form Hacks Used to Send Spam