Find out which user released a mail from spam queue

check the journal and /var/log/pmgproxy/pmgproxy.log during that time-frame that should provide the information.