A lot of spam messages on Linux - possible rootkit?

view story

http://www.linuxquestions.org – Hello! I have a big problem with SPAM on my cPanel server. SPAMHAUs add my IP adress to CBL list :/ In /var/log/exim_mainlog i don't see anything suspicious logs, but netstat return strange connections from root sshd to 25 port. Code: tcp        0      0 x.x.x.3:37628            ESTABLISHED 712912/sshd tcp        0    31 x.x.x.18:50213            ESTABLISHED 856003/sshd (HowTos)