I'm sure you've already checked this but make sure your not running an exploitable version of formmail.pl.