Malicious Outgoing Connection to another server

Hi, There was a malicious outgoing connection from my Cpanel server to an another server's FTP port. My server has about 200 shared hosting accounts of my clients. How can I check which user/account sent this outgoing FTP request. Please suggest.