Finding a device sending spam emails

edit

One way can be to disconnect one device for one or two days around that date and see if emails are still send. If yes, then proceed with the next device. Time consuming... But if you deal with that error every step brings you closer is a good step.

Another maybe better way could be to buy you a cheap managed switch (e.g. https://www.amazon.de/Netgear-GS105E-...) and connect your LAN devices to that switch. Then you can connect this switch to your Router. After that you can define a mirror port for this Uplink and then you capture your traffic.

A third way is the proposal of @Graham or you can replace your router by a fritz box which also has build in capture functions.

In a typical home environment this is not that easy to accomplish as you'll have a single combined router\modem\access point that you are unable to capture on. You could try to capture on each device as suggested in the answer from @Ross Jacobs, but that won't work for mobile devices.

If you are able, installing alternative firmware such as OpenWrt on the router\modem will allow you to capture on the router\modem, but that's not a trivial operation.

Take a capture with Wireshark and then filter with tcp.port == 25. That should show you any SMTP traffic.

Edit: @grahamb is correct here. I should have specified that you would need to take this capture on the upstream device, whichever that is. Without some networking/IT background, this will be difficult for you to accomplish

If you are not versed in networking / IT, you may want to talk to a friend or hire a consultant, as getting your internet access back will likely require hands-on expertise.