We got an email from Siteground about a suspicious number of outgoing emails from
public_html/index.php. They've blocked the site from sending emails. Which we need to resolve.
There is no contact form on the homepage, but I would assume that index.php could also be other pages. Is this correct or a bad assumption?
Is the assumption that it is a contact from is also presumptuous. Could this be core?
I assume this could also be the template?
Aside from updating extensions and core. What's the best way to troubleshoot this so we can get the site sending emails again but without getting the domain blacklisted.