Mass Mailer can't be used to send spam unless you have an administrator deliberately using it to do that. It is only functional from backend CB > User Management and only allowed for administrators. Suggest you evaluate who you've given administrator access to and remove their access immediately.

No, the mass mailer can't be disabled. Simply don't give people you don't trust backend access. You probably have a user sending other users emails from their profiles directly using the email form, which you can disable by setting "Email Handling" to "Do Not Display Email" within CB > Configuration > General. Beyond that you'll need to discuss with your server host to review mailer logs to see what exactly is being sent. It could also just be your host is flagging emails as spam because your Welcome or Pending registration emails in CB > Configuration > Registration could contain too many flags or is too generic; again something you need to discuss with your host.