The following cPanel/Exim configuration will help you stopping spam in the server.
1. Login to WHM control panel
2. Goto Main >> Service Configuration >> Exim Configuration Manager
3. Enable RBL filtering by Basic Editor >> RBLs >> switch to “On” and if you like you may additional RBL from manage option.
4. Enable Sender Verification by Mail >> Sender Verification >> “On” this will check if the mail origin really exists.
5. Reject SPF failures by ACL Options >> Reject SPF failures >> “On” this will verify SPF records and if the SPF record is set to fails then the E-mails from those IPs will be rejected.
6. Home >> Server Configuration >> Tweak Settings
7. Turn “Initial default/catch-all forwarder destination” to “fail” this will fail the catch all feature to be sent to default cPanel account.
8. “Set Max hourly emails per domain” which will limit the E-mail flooding from the server(I normally set it to 70 which is good enough for a single domain for an hour).
9. Set “Maximum percentage of failed or deferred messages a domain may send per hour” everyone knows that Spam E-mails will have alot of non existing E-mail which will then be deferred so If we set this to say 50% the spamming E-mail account will be suspended temporarily if the deferred mails are above 50%.
10. Then save all the configuration this will stop most of spams in the server.