You analysis corresponds extremely close to my analysis. The big clue is
[email protected]. What is missing from your analysis is examing the CRON log, found on my CentOS 6.4 64-bit in /var/log/cron.
In my case I was lucky to find the culprit quickly because I have SNMP monitoring on Postfix...