A way to stop outgoing unauthenticated spam mail

Hello, we've a problem with all of our customer that have compromised CMS installation that is sending outgoing spam. In most of the case, we realize the problem with the setting "Max hourly email per domain", so we suspend the account and notify our consumer. The ip address of our server goes in blacklist after this and we realized that we must prevent this spam action. There is a way to reject this mail? I note that spammers change the FROM name, so we think that if we blocking all unauthenticated mail (sent from mail() function) with an external domain (not the local main domain), we can solve 85% of the problem There is a way to do this in exim configuration? We've blocked successfully authenticated mail with external from address thanks to this topic Thanks :)