The answer will be in the logs somewhere.
If the SMTP service says the email originated from 127.0.0.1, then the spam is not being submitted to the server with SMTP, it's being generated by something locally. So [and this is a bit of a guess] the next most likely source would be the web interface, but you say it's not internet facing?
I've never used NuPoint but if it's anything like any other MSL, web server logs will be in /var/log/httpd/. Have a look in there and see if there are any IP addresses you don't recognise.