my question is, exist it a script (except snort) to see who is running sendmail ...
No, I dont think so. You can not even see this with snort as sendmail is a binary on your server which is invoked by shell scripts and also by php to send emails, so there are no network connections to this program, its just a normal commandline call.
If you see this error regularily at a specific time, then check which cronjobs are running at this timepoint.
If the probelm started just recently, you might be able to find out which new script has been installed that causes this error.
In general, the error is not critical, it affects only the script that uses the command wrong in that way that the email that the scripts tries to send will not arrive. So sooner or later you should be abke to find the script as its email sending functions just did not work at the moment.