Here's Symantec's document re: Active Directory integration: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007092721431648 When you talk about "how SEP authenticates on the domain", I'm going to assume you're referring to SEP's access to the directory to perform its cruddy "synchronization" of OUs of AD into its own database. When add a "Directory Server", you will enter a username and password used to bind to the LDAP server. The account used here does not need "Domain Admin" or any other high level of privileges. The stock permissions on an Active Directory permit a non-privileged account to perform the LDAP query necessary to return user, computer, and OU objects. Unless you've made heavy modifications to your AD's stock permissions, you won't need this account to be an "Administrator".
The account used for directory service access is not created by the product's installer automatically. I'd turn on "Advanced Features" in Active Directory Users and Computers and examine the "Object" tab of the "Symantec" user you found to try and pinpoint when it was created to figure out where it came from.
My condolences to you for having to deal with SEP. We had some awful experiences with it and are transitioning Customers away from Symantec. At this point, I wouldn't even recommend SEP to terrorists, thieves, or other malcontents. It's just that bad.