Both postfix and qmail have quite thorough privilege separation. Most people run Postfix out of the box (apt-get install, answer which domains you want to rout

Both postfix and qmail have quite thorough privilege separation. Most people run Postfix out of the box (apt-get install, answer which domains you want to route mail for, done) and it's completely solid. Wietse Venema had a name for himself in security circles long before he started writing it. DJB too. Neither is likely to be the vulnerable link in your system.