I don't think you did something wrong.
Just start your Computer, let it run 5/10 min (to get the error at halt)
And before halting the system, try to umount /var as root.
Now check if you get the same error.
If the reply is YES, its good !
try that:
fuser -v /var
will return what process ID is in use of that directory. Its probably your mail deamon/client that check your mailbox every 10 mins, and use /var/spool/mail to put new received messages. But I'm tired, so do not read this