Grrrrrr....but at least know I think I know
As I read in another post, my mail_admin's password has a '#' character in it
so in /etc/pam.d/smtp, everything after the start of the password is ignored, hence "db" is not set. I am getting so used to reformatting and doing it again that I think it will be quicker than trying to find all the instances and changing them. It makes sense though.
We live, we learn.