The truly pertinent piece of this is that the sa magic was in /etc/procmailrc so we didn't see any signs of it in the log. The moral is don't put /dev/null rules in the /etc/procmailrc file.