In cPanel prior to 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
cpanel cpanel