If it is coming from the vuXXXX account, it is likely that the website has some mailform exploit or something that is being exploited. I've had this happen on several sites in the past. At least since its running as the user, you have it narrowed down to what site is making the calls. Thats a lot better than where i have been stuck in the past, with apache sending out mails as itself.
If they do have a mailform on their site, just a reminder that all the legitimate email that would have been sent from that (customers, etc) will now be dropped! You need to get to the real issue of what is being exploited.
-
Jesse