how to tell which process call sendmail

[Glenn McCalley]

So, some idiot is using a cgi or php or something to send mail out of his 
website that he shouldn't be sending.  With a bunch of sites on the server, 
can't tell who.

System accounting can tell me that sendmail was executed 32,976 times, but 
is there a way to tell what process /file name called it each time?  Since 
it's always called by the www user that doesn't help -- I need to 
distinguish between legit processes that call 5 or 10 in a day and the idiot 
who calls the other 31,000 times.

Thanks!
Glenn.