Centos/cPanel Server Security EXIM and CSF Expert

Have two domains that have been hacked and are sending out spam or possibly worse. They are disabled at this point but the cause, removal, and prevention needs to take place. These are traditional HTML sites with some PHP-based programs like Gallery running. The spam has already caused some blacklisting and needs to end. I don't know if the server or other domains are also replying to or in other ways come off as sending spam. 1. the method the hacker or hackers found access to the domains 2. find what they did and remove it to stop the spamming and whatever other nefarious action they are doing 3. be able to "harden" EXIM and CSF to prevent spamming 4. other server hardening methods as well as monitoring tools to alert to these issues I will want a summary of what was found, how it was removed, how it happened, and what steps were taken to prevent it. Good communication is necessary for project success.