There seems to be some script in the server which is executing as apache user and sending mails. Looking at ps aux output we find that sendmail executable is executed with apache user but we are not able to find specific script which is doing this.
What is the ideal way to deal with this kind of situation ?
grep -rnw '/var/www/' -e "mail"
orgrep -rnw '/var/www/' -e "exec mail"
It could also be a PEAR module. Sadly only the execution is logged, not the script calling it.