Oh, yeah, you didn’t mention your OS/version. We had a weird issue similar to this a while back on Gentoo, though I don’t remember exactly what was going on…but basically Procmail wasn’t dropping privileges due to a bug in dealing with a non-existent /var/mail or /var/spool/mail directory (even though Maildir is being used and this directory never gets anything written to it…procmail just seemingly has some crufty old code that assumes it exists, and quietly fails to do the right thing if it doesn’t).
It probably is a bug. We seem to be having a lot of mail-related issues this past week or so, so I think something is failing midway through configuration that is causing many of the steps to be skipped. I need to make virtualmin-base a bit more robust, methinks.