Diagnose a compromised mail configuration causing outbound spam

Hosting provider's email this morning:

["Your server's outbound IP has been added to the Spamhaus blacklist due to a
high volume of outbound mail flagged as spam. Mail delivery from your server
is now degraded across most major providers."]

Checking the site's mail logs:

[- Roughly 8,400 outbound emails sent in the last 18 hours through the site's
SMTP plugin, versus a normal daily volume of about 40 (order confirmations and
contact form notifications)
- The vast majority of the surge routes through the contact form plugin's
notification handler, addressed to recipients that don't match any customer or
subscriber on file
- The SMTP plugin's API key hasn't been rotated since the site launched two
years ago
- No new admin users, no new plugins installed, no core file changes flagged]

Diagnose and respond the way this needs sequencing, not just "turn off email":
1. Narrow down the likely cause from what's given: since the surge routes
   through the contact form's notification handler rather than being sent
   directly via wp-admin or a compromised account, this points toward the
   contact form itself being abused, either a header-injection or open-relay
   style flaw letting someone submit forms that generate mail to arbitrary
   recipients, rather than a stolen WordPress admin account. Explain why the
   absence of new users or file changes supports that read.
2. Immediate containment to stop the bleeding before investigating further:
   temporarily disable outbound email from the contact form (or the whole site
   if needed) and rotate the SMTP plugin's API key immediately, since a
   two-year-old unrotated key is itself a standing risk regardless of how this
   specific incident started.
3. Root-cause the entry point: check the contact form plugin's version against
   known CVEs for header injection or mail-relay abuse, inspect recent
   submissions for unusual patterns (recipient fields, bcc-style injected
   headers, or abnormal submission rate from a small set of IPs).
4. Once the hole is closed and confirmed, lay out the delisting process: what
   to fix and document before requesting removal from the blacklist, since
   providers typically want evidence the abuse has actually stopped, not just
   a promise.
5. Recommend ongoing monitoring that would catch this faster next time, such as
   alerting on outbound mail volume that spikes well past the normal daily
   baseline.