1. Execute 'cat /var/log/maillog|grep PWD' and then you can see (example):
Mar 18 04:30:25 oln3 root: sendmail: CALLER="/opt/php54s/usr/bin/php -c /opt/php54s/custom/php54s.ini ../bin/common/background.php /tmp/backgroundtlhlI8" PWD="/usr/local/lxlabs/kloxo/httpdocs" BAN="no"
Mar 18 11:24:51 oln3 root: sendmail: CALLER="php-fpm: pool devel" PWD="/home/devel/forum.mratwork.com" BAN="no"
So, you know where sendmail came from. In this example is '/home/devel/forum.mratwork.com'.
2. If you want ban '/home/devel/forum.mratwork.com', add '/home/devel/forum.mratwork.com' to '/var/qmail/control/badsendmailfrom' file.
3. Next time you will see:
Mar 18 11:24:51 oln3 root: sendmail: CALLER="php-fpm: pool devel" PWD="/home/devel/forum.mratwork.com" BAN="yes"