I'm trying to figure out the source of some failing email to root@ on an internet server. I don't know if it is anything to do with exim4, but that's the MTA.

I can see the logs of the attempts with the external server in /var/spool/exim4/msglog, and what looks like a log of messages received by exim4 in /var/spool/exim4/input. [Seems odd that I can't cd to some of the directories - even with sudo] But I haven't been able to figure out the source of the emails.

I've searched all the mysql databases for the string - no luck.

I'm trying to search the entire disk for the string, but I'm not sure if I'm doing it correctly.
sudo find / -print | sudo xargs grep string
Any ideas would be most appreciated.