The debian default setup for SNORT has the daily summary mail sent out from 'root'. While accurate, this is not ideal when it comes time to file (for some reason, it's easier for my brain to locate the 'snort' folder when I'm looking at mail from 'snort' instead of mail from 'root'). In any case, modify the /etc/cron.daily/5snort file and add 'echo "From: Snort <root>";' after the 'echo "To: $DEBIAN_SNORT_STATS_RCPT";' section.