Unlikely to be a plugin, unless you've installed some really dubious stuff - I think you need to look closely at the emails to track back where they're coming from. What is the (non virus laden) content? Subject?
Most important - what do the headers say? It could be just that someone has found the outgoing email address that your Confluence would use and is simply using that email in the header (in other words, they're nothing to do with your Confluence, they just have the same email address)
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.