The local(8) delivery agent delivers mail to mailboxes (and maildirs)
and commands found in .forward files with the privileges of the user.

Deliveries to commands (and mailbox files) in aliases files use the
aliases file owner if not root, otherwise the $default_privs user.