Zimbra mail server check for spammer account

Useful cmd for quick checking compromised account in case of internal spam:

cat /var/log/zimbra.log | sed -n 's/.*sasl_username=//p' | sort | uniq -c | sort -n

Accont with much difference in sent mails is the one to inspect...