I've seen that before on servers with open relays like formmail or cgiemail. You might want to check for any kinds of programs like that on the server.
You'd still see the send in var/log/messages though, wouldn't you? At least I do in any CGI that sends mail.
====================================================================== Technical questions regarding this list may be sent to <vps-mail-owner@xxxxxxxxxxxx>. You may request an automated help response by sending an email with the word 'help' (w/o quotes) in the BODY of the message (subject is ignored) to <vps-mail-request@xxxxxxxxxxxx>. ======================================================================