[till]

If i remember correctly, proftpd itself is running as root, if someone connects, a child process is spawned, the child access drops priveliges and runs as the user that has connected until the ftp connection ends.

So i think this report is OK.