I'm sorry to hear you're having these issues. I believe you can fix this with a couple of quick changes. Under Settings>Protocols>SMTP IN please ensure you have the following values setup:
Once set, this will prevent external users from sending mail as users on your domains without authenticating beforehand. Once completed, you can use this KB article to clear out your spool of the malicious content:
Kyle Kerst
IT Coordinator
SmarterTools Inc.
www.smartertools.com