This is the sender address and not nescessarily the account which is used to send the emails. Dont mix that up, thsender address and sending account can be the same but dont have to be the same!
I also do not see any authenticated user logged before this.
You have to find the login when the first spam email of a session is sent, there is no new login for each message.
There are 3 options:
1) The emails are send trough a local script.
3) The emails are sent trough a authenticated account.
4) Your server is a open relay (check: http://mxtoolbox.com/diagnostic.aspx
If you want to find out more of the emails, then you can inspect their headers with postcat command in the queue.