Also check for ports 587 and 465. These are remote ports you want to look for; that is, the port being used by the remote mail server, not the port being used by the spamming client.

You should be able to find these with Tomato pretty easily. Just create a QoS classification specifying those three ports (25, 587, and 465), then "View Details" of the class you assigned them to. Not all email connections are going to be spam, so find a single computer that has a lot of connections going on.

Once you have the IP address, go to any computer on the same LAN and ping the IP address. Then run "arp -a" and find the mapping between IP and MAC. If you have disparate computers, it might be useful to discover the NIC's manufacturer.

If you had managed switches, it would be pretty easy to find the exact port the computer is connected to, but I don't know if your switches are managed.