The pop daemon must be able to write to the /var/mail DIRECTORY. Oh, and with those permissions on your Mailbox (why it's named Mailbox is beyond me) allows ANYone to read your mail and anyone in group USER to write (change) your mail.
Usually, the group is set to 'mail' not 'user'; Qpopper normally runs with group 'mail' and the UID of the user. This normally allows it to access the spool directory.
--
Randall Gellens
Opinions are personal; facts are suspect; I speak for myself only
-------------- Randomly-selected tag: ---------------
The irony of the Information Age is that it has given new
respectability to uninformed opinion. --John Lawton