Spambot issues

New to Tomato and I'm trying to find out how best determine which computer on the network is infected and sending out spam.

I've added a firewall scripts, based on what I've read on other threads.
iptables -t filter -A wanout -p tcp -d smtp.telus.net --dport 25 -j ACCEPT
iptables -t filter -A wanout -p tcp --dport 25 -j LOG
iptables -t filter -A wanout -p tcp --dport 25 -j DROP

Any other tips appreciated, thanks!