Index: spampd.pl
--- spampd.pl.orig
+++ spampd.pl
@@ -429,8 +429,8 @@ sub new {
       max_servers       => 5,                     # max number of child processes (servers) to spawn
       max_requests      => 20,                    # max requests handled by child b4 dying
       pid_file          => '/var/run/spampd.pid', # write pid to file
-      user              => 'mail',                # user to run as
-      group             => 'mail',                # group to run as
+      user              => '_spampd',             # user to run as
+      group             => '_spampd',             # group to run as
       log_file          => undef,                 # log destination (undef means log to use write_to_log_hook() with stderr fallback)
       syslog_logsock    => undef,                 # syslog socket (undef means for Sys::Syslog to decide)
       syslog_ident      => 'spampd',              # syslog identity
@@ -2080,7 +2080,7 @@ Specifies what UNIX socket spampd will relay to. If th
 =item B<--group> or B<-g> I<<groupname>>
 
 Specifies the user and/or group that the proxy will run as. Default is
-I<mail>/I<mail>.
+I<_spampd>/I<_spampd>.
 
 
 =item B<--children> or B<-c> I<<n>>