SMTP trying to send every 10 minutes -- how to track down culprit

[RAINMAN]

Basically in my system log every 10 mins on the 1 (11, 21, 31 etc) I get this log entry that its trying to send an email.  I setup the SMTP server in notifications and tested it works fine.  I changed it from one domain to another and it changes the sender address domain it tries to use but its not changing the user its using.  Its setup to send from fileserver at scne but for some reason its trying to send as root.

 

Sep 22 07:21:25 FILESERVER sSMTP[16472]: Creating SSL connection to host
Sep 22 07:21:25 FILESERVER sSMTP[16472]: SSL connection using TLS_AES_256_GCM_SHA384
Sep 22 07:21:27 FILESERVER sSMTP[16472]: RCPT TO:<fileserver (AT) scne xyz> (553 5.7.1 <root at scne xyz>: Sender address rejected: not owned by user fileserver (AT) scne xyz)

 

I removed the @'s to prevent spam bots scraping the email address.

 

I guess I tracked it down to notifications as the place its getting some of the email details but I have no idea what would be trying to send every 10 mins and since its trying to send from an invalid email I dont know what its trying to send.  Any way I can track down whats causing this?

Edited September 22, 2021 by RAINMAN

[RAINMAN]

Update: I managed to see the process that runs: 

 

root 16380 0.0 0.0 8936 5220 ? S 08:01 0:00 /usr/sbin/sendmail -t -oem -i

 

But still meaningless to me.

[RAINMAN]

Edit, close this.  I created a root account to see what was being sent and it was a plex export script output.  The cronjob was redirecting the output to mail instead of /dev/null