in reply to Security of Sendmail and -T error

Regarding your point 2, could this passage from perlrun be a clue?
PERL5LIB
....
If PERL5LIB is not defined, PERLLIB is used.
....
When running taint checks (either because the program was running setuid or setgid, or the -T switch was used), neither variable is used. The program should instead say:

      use lib "/my/directory";