I note spamassassin starts and runs although we do not have it enabled.
[root@merlin e-smith]# ps -ef |grep spamassassin
root 26768 26347 0 11:32 pts/0 00:00:00 grep spamassassin
Umm, 2 problems here:
1) The line above isn't showing SA running, it's showing that the grep command has spamassassin in the commandline. The pts/0 shows that it's being run from an SSH command prompt.
Replace spamassassin with wibble and it would show the same thing:
[root@mailgate root]# ps -ef |grep wibble
root 21783 21569 0 23:06 pts/0 00:00:00 grep wibble
2) Spamassassin actually runs as spamd - this is mine:
[root@mailgate root]# ps -ef |grep spamd
root 26898 1 0 Apr16 ? 00:00:00 /usr/bin/spamd -d -c -m5 -H -r /
root 20202 26898 0 Apr16 ? 00:00:26 spamd child
root 20203 26898 0 Apr16 ? 00:00:02 spamd child
root 21623 21569 0 22:59 pts/0 00:00:00 grep spamd