Earlier today I had Evolution mail lock-up (never happened before). I then tried to close it and it disappeared visibly (window closed). When I tried to load it up I got an error saying that another instance may have failed to close properly. This was probably true.

Now the alarming bit. I went into Task Manager and saw about 30 Evolution processes running as root. They seemed to be spawning at one process every few seconds. My CPU was at 100% although was not lagging strangely (hex-core).

Task Manager does not seem to allow multi-select so I opened System Monitor and multi-selected all Evolution processes and killed them. This fixed the problem and opening Evolution the worked as normal and processes appeared and ran under my username.

How can the behaviour be explained? Why would a program run as root when it does not normally? I have no idea if anything else happened in the background...

Everything is fine now, but you know "once bitten, twice shy"...

Confirm, carefully, that the Evolution processes were actually "running as root." Look for any log-file entries they may have left behind. You are correct to be alarmed and suspicious, but this behavior seems quite odd. Be sure it was not a false-positive.

The System Monitor "User" column said "root" for all evolution processes. All others had my username and evolution now has my username after killing the other ones. I will see what else I can find, but why would System Monitor show the root user at all for these processes?

Thanks

Do you have sudo setup with no password?

Nope, password is always prompted for.