On a webserver, I am seeing unknown processes invoking sendmail like
root 1544 1188 0 03:42 ? 00:00:00 sendmail: ./qBBJ2gNg014264 mail.furst.com.: user open
I have DROPed all SMTP destination ports via iptables. Have confirmed this by seeing SYN_SENT for such connections via netstat.
How can I find / stop / remove these unknown processes running sendmail?
UPDATE: The OP has said that the machine is running Drupal.