Spam from same mail account

We have a customer receiving spam from his own account. (customer@example.com is emailing customer@example.com spam). 1. We have SMTP restrictions turned on. 2. We have changed the email password but the spam persists 3. We also use SpamExperts and I am unable to locate the spam mail on the spam dashboard which leads me in believing the mail is originating from the server or from our network which would essentially bypass SpamExperts and just deliver the mail. 4. The customer has no mail script or related CMS which is setup to send mails on our server. Even if he had with smtp restrictions and a changed password this should not be happening. 5. The customer has no forwarding rules setup on the server or his devices. 6. From my understanding the customer has the account setup on both his mobile and laptop. I have been advised to look at the headers of the mail but I am a little unsure how to do this as the mail is delivered to the customer / not in the queue so I am not sure how to view this data. Any other ideas? We have had a similiar issue a couple of months back with a different customers so I want to make sure that the issue does not affect all of our customers. Thank you!