Question
Most of the email generated from the server appears to be from the user "mailnull", and it's sending out a lot of emails. Who is this user?
Answer
The user mailnull is utilized by the Exim service, this is quickly verified by reviewing the process Exim is operating under in the ps command:
# ps -uU mailnull | head -2
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
mailnull 341 0.0 0.0 83648 5576 ? S 10:06 0:00 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid
It's not uncommon to see 5-10 of these processes at a given time if the server undergoes moderate to heavy mail activity. In select instances, the user at times can be found from the Dovecot service as well.
Exim uses the mailnull username when sending bounce back messages, so logs that show the mailnull user sending messages are not a problem in and of themselves.