Wireshark for spam

I captured and filtered for SMTP data using mirroring. Now that I have my capture, how do I read it. There are entries highlighted in black that say "tcp retransmission...bluewave7" and a huge section in blue that says "get response". I'm trying to determine which workstation is generating spam.