First off - move hosts. If they aren't giving you control, there are things going on outside of your control. VelocityWebHost - my company, gives you full PLESK control - no Virtuozzo!

Second - if you are getting bounced mails, it may be a relay on your mail server. You'd need to look at the headers of the bounced message. I doubt it's from XOOPS.

Third - if you are worried about the Contact Us page exploit - Here's the real SPAM killer for Contact - XOOPS 2.0.13.x or for XOOPS 2.2.x

If you want to find out if you are a relay and your host won't tell you much, just plug in your shared IP to dnsstuff under the Spam database lookup - that will tell you if there is any real damage. Godd luck!