from /etc/passwd:
backup:x:34:34:backup:/var/backups:/bin/sh
The home directory listed is /var/backups which is owned by root:root. Here are the contents of the home directory:
total 4.1M
drwxr-xr-x 2 root root 4.0K May 29 11:17 ./
drwxr-xr-x 13 root root 4.0K May 28 00:32 ../
-rw-r--r-- 1 root root 11K May 28 20:16 apt.extended_states.0
-rw-r--r-- 1 root root 1.4K Apr 28 16:50 apt.extended_states.1.gz
-rw-r--r-- 1 root root 1.2K Apr 14 21:06 apt.extended_states.2.gz
-rw-r--r-- 1 root root 1.1K Apr 7 13:45 apt.extended_states.3.gz
-rw-r--r-- 1 root root 1.1K Mar 28 22:00 apt.extended_states.4.gz
-rw-r--r-- 1 root root 1.1K Mar 18 22:26 apt.extended_states.5.gz
-rw-r--r-- 1 root root 970 Mar 14 23:52 apt.extended_states.6.gz
-rw-r--r-- 1 root root 1.6M May 28 20:16 dpkg.status.0
-rw-r--r-- 1 root root 432K May 27 23:04 dpkg.status.1.gz
-rw-r--r-- 1 root root 431K Apr 28 16:50 dpkg.status.2.gz
-rw-r--r-- 1 root root 426K Apr 14 21:06 dpkg.status.3.gz
-rw-r--r-- 1 root root 420K Apr 7 13:45 dpkg.status.4.gz
-rw-r--r-- 1 root root 418K Mar 28 22:00 dpkg.status.5.gz
-rw-r--r-- 1 root root 416K Mar 20 21:08 dpkg.status.6.gz
-rw------- 1 root root 918 May 28 20:12 group.bak
-rw------- 1 root shadow 758 May 28 20:12 gshadow.bak
-rw------- 1 root root 1.8K May 28 20:12 passwd.bak
-rw------- 1 root shadow 1.2K May 28 20:12 shadow.bak
Obviously, these are backup files of some sort but which process is creating them? I did a quick find to see if this user owned anything but it didn't turn up much:
$ sudo find / -user backup
/var/mail/backup