too much outbound traffic to hotmail

I reported too much traffic coming from my exchange server outgoing to hotmail servers.
There are no message in the smtp virtual server.
Ip adresses are changing from time to time and tcp ports are changing too (of course always to or from my smptport). Ip addresses are always hotmail servers.
Packets are not filled with text.
Our antivirus soft is up to date, a firewall is present. The server is configured to not be used as relay.
The traffic is very important using almost all of the outgoing bandwith
As somebody an idea ? Spam ? another way for relaying ? Virus ?
How to identify what and how to correct it ?