Perhaps the ssh connection running 'tail -f spamlog' is what tipped off the security team.