It turns out that there is a cronjob to delete files from /var/www/wwtmp/. And it was hitting permissions issues while doing that. And then sending a message to the 'faculty' user's mail. It had been growing since, my guess is 2013.
Deleted the file, and addressed the underlying permissions issue.