Code:
grep -R -i passthru ./
Run this in the home directory of your websites.
Example,
/home/sites/website1.com
/home/sites/website2.com
Run it in /home/sites so that it covers them all... If you find a script that resembles the one I posted previously, you've been hacked.