On a new Debian stable install, exim4 will accept mail for local user "mail", and save it to /var/mail/mail. If you also tell exim4 that you want to use Maildirs rather than mbox files, it will create and populate /var/mail/Maildir instead. I'm not sure whether this is can be considered a bug or not, but if you don't want this, add

mail: :fail:

to /etc/aliases. I've just discovered 1,664 spams on one site sitting in /var/mail/Maildir.