from the suexec.log
Code:
[2011-11-29 13:17:01]: uid: (5003/ispconfig) gid: (5004/5004) cmd: .php-fcgi-starter
[2011-11-29 13:17:02]: uid: (5003/ispconfig) gid: (5004/5004) cmd: .php-fcgi-starter
Not being familiar with suexec, I'd say that this just indicates that it fired off, not necessarily that it blocked it, am I right?