Tell us some details about your Zimbra set-up, start with the putting the output of the following command in your
forum profile (don't post in this thread):
When did this problem start? Why do you think it's your system sending spam rather than NDR Spam that you're receiving? Which account is sending the spam? Have you checked to see if that really is the case? Is the 'compromised' account a local or remote user? Have you checked to see if you're acting as an open relay (search the web for sites that will check that)? Are all the machines on your LAN clean, have they been checked for viruses or bots recently?
Do you also have a strong password pilocy for your Zimbra user accounts?