hunting trojans: does vmail user need its own crond??

[robert rottermann]

Hi there,

I think I am infected by a trojan or some such.
I found out because the machine landed on the dronebl blacklist, and they say I 
still hit them ..

Trying to hunt the reason down I found that the vmail user (which is used by 
dovecot) has its own crond running.

Is that usual?

thanks
robert