Thanks, Bitt. Yeah, well, 2 questions:

1. How can I stop these messages to root without killing all the legitimate bounces from typos in real emails? If they went to a log instead of the root mailbox, then log rotation would take care of it. So yeah, how do I keep var from filling?

2. How can I make sure my system isn't compromised?

(3). Is this normal?