Fix hacked server

The SMTP portion of our server has been hacked and is sending out spam via the server's admin account (which normally is used to send alerts to the hosting company's admins). We do not want to be responsible for sending out spam, and the bounces are using up all of the storage space, so we are no longer able to add any new content to our site. We need someone to not only stop the server from sending any more spam, but also need a diagnosis of what vulnerability the server has that allowed this to happen, and to harden it against similar future exploits. We will expect a full report on what the vulnerability was, how the problem was repaired, and what steps were taken to prevent recurrence. The server uses CentOS 5 and does not have a control panel, so you will need to be able to SSH in. Thanks for your consideration!