How to disable apache@domain user from sending emails

NethServer Version: NethServer release 7.9.2009 (final)
Module: Email

This is driving me nuts.
I a trying to stop a spammer from abusing badly written web forms and several sites. The users just aren’t interested in changing the forms.

The mail always comes from apache@mydomain but I see no way in blocking sending from this non existent user. Dovecot dutifully sends out the mail as it’s local host.
I’ve included the

 php_value  disable_functions  mail

in the .htaccess file but it looks like its being ignored.

Where can I put the “disable_functions = mail” so it only disables the mail for each site and not the lot?

I can’t disable sendmail totally as several sites are using email from prestashop. I am thinking of throwing the whole thing into the bin and creating a new box for the good sites and then setup a platform that will allow me to delete sendmail on the bad sites… I shame that the tick box in cockpit doesn’t work on Enforce sender/login match under relay.

Any help much appreciated… otherwise I’m off to proxmox and a new server rebuild.

disable_functions can only be used in php.ini

Apparently suhosin extension has suhosin.executor.func.blacklist that can be used per site.