Looking at the top command, some times the user that run the spamd is root, another is mailnull. Someone know why? maybe there are 2 instances of spamd running?

thanks.

mailnull is the exim username. If you configure apamassassin using our instruction, when the spamassassin run it will run as mailnull.

For the user root, it is the checkservd which test spamd whether it is running or not.