The only cms that is running on this server is a Wordpress install (all up to date with no funky plugins!) but the email headers show that the emails are not coming from a script on the server.
I have run the following postfix config to see if it helps:
postconf -e ‘smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_non_fqdn_hostname, reject_unknown_recipient_domain, reject_non_fqdn_recipient, reject_unauth_destination, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unknown_recipient_domain, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination’
under System >> Config >> Mail >> Real-time Blackhole List