Looking at the script, it appears to trigger if anything is listening on port 465/tcp. /etc/services lists that as "SMTP over SSL". Are you sure it's not just detecting your mailserver?

Isn't there some tool which, given a port, will tell you which local PID is listening on it?

Peter