>>Dec 14 22:43:28 acheron sendmail[1464]: NOQUEUE: Null connection from
>>root@localhost
>
>Could a sendmail of some sort simply be starting a connection, and breaking it
>off before it gets fully connected? IE in one of the ACK_WAIT states?

nope.

* if it was trying to connect out somewhere and failed, it would
  simply leave the associated message in the local queue and try
  again later.

* if something was trying to connect to it and dropped, you see a line
  like this:

  Dec 16 12:39:56 noc sendmail[22280]: NOQUEUE: Null connection from noc.untraceable.net [198.67.15.13]

* if something was trying to connect in and never completed the
  three-way-handshake, sendmail would never see it.

* if someone other than root ran it from the command line with -bs,
  you see their name instead of root.

-- 
|-----< "CODE WARRIOR" >-----|
andrew@echonyc.com (TheMan)        * "ah!  i see you have the internet
codewarrior@daemon.org                               that goes *ping*!"
warfare@graffiti.com      * "information is power -- share the wealth."