There are things you can do on a machine that will NEVER perform
local delivery to let it run as a "null user".  It needs to bind
to port 25 and deliver to mqueue.  I've used sendmail -bs in
inetd on machines with fairly light usage and done this (inetd
does the port 25 handling).

See also RunAs user and other options.

Again, local delivery, .forward files, etc cannot be used.

Quoting Andrew Brown (atatat@atatdot.net):
> >Shouldn't the owner of /var/spool/mqueue be smmsp? My daily builds of
> >current keep changing it to root.
> 
> your build is correct -- that directory should be owned by root, not
> smmsp.
> 
> >My sendmail keeps complaining, and I keep switching it back.
> 
> how exactly is it complaining?
> 
> -- 
> |-----< "CODE WARRIOR" >-----|
> codewarrior@daemon.org             * "ah!  i see you have the internet
> twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
> werdna@squooshy.com       * "information is power -- share the wealth."