In KloxoMR latest, one of the webmail clients is using the /tmp/ directory to compile and cache web output (smarty template system - I think).
CSF does not like php files being in the /tmp and will start sending you mass emails.
This will fix that <!-- s:) --><!-- s:) -->
vim /etc/csf/csf.fignore
ADD this to the bottom
/tmp/%.*
Done.
@Farrow, you are mistaken, and obviously your inexperience has caused this issue, as this fix HAS NOTHING TO DO WITH BLOCKING IP OR SSH. The file fignore is for FILES that LFD should ignore as being threats, THAT IS IT!
If you are using SolusVM for vps, or if it is a dedicated server, either way, start a serial console, once logged into this console, issue this command: csf -x